cs_yara

Cobalt Strike Yara ルールをチェック

参考リンク

BeaconEye バグ修正: https://wbglil.gitbook.io/cobalt-strike/cobalt-strike-gong-ji-fang-yu/untitled-1

https://raw.githubusercontent.com/CCob/BeaconEye/master/BeaconEye.cs より取得したルール

beaconEye.yar

rule CobaltStrike { 
  strings:  
    $cobaltStrikeRule64 = {  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  01 00 00 00 00 00 00 00 (00|01|02|04|08|10) 00 00 00 00 00 00 00  01 00 00 00 00 00 00 00 ?? ?? 00 00 00 00 00 00  02 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00  02 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00  01 00 00 00 00 00 00 00 ?? ?? 00 00 00 00 00 00 } 
    $cobaltStrikeRule32 = {  00 00 00 00 00 00 00 00  01 00 00 00 (00|01|02|04|08|10) 00 00 00 01 00 00 00 ?? ?? 00 00  02 00 00 00 ?? ?? ?? ??  02 00 00 00 ?? ?? ?? ??  01 00 00 00 ?? ?? 00 00 }
  condition: any of them
}

yara ダウンロード

https://virustotal.github.io/yara/

https://github.com/virustotal/yara/releases/latest

cs ビーコン

PowerShell チェック

powershell -command "Get-Process | ForEach-Object {./yara64.exe beaconEye.yar $_.ID -s}"

cs_yara

人気

cs_yara

参考リンク

beaconEye.yar

yara ダウンロード

cs ビーコン

PowerShell チェック