DefenderYara/HackTool/Win32/CobaltStrike/HackTool_Win32_CobaltStrike_K_.yar

rule HackTool_Win32_CobaltStrike_K_{
	meta:
		description = "HackTool:Win32/CobaltStrike.K!!CobaltStrike.K,SIGNATURE_TYPE_ARHSTR_EXT,01 00 01 00 02 00 00 "
		
	strings :
		$a_01_0 = {33 d2 6a 0d 8b c1 5b f7 f3 8a 44 32 0c 30 07 41 } //1
		$a_01_1 = {8b 3b f7 f6 01 cf 41 8a 44 13 0c 30 07 } //1
	condition:
		((#a_01_0  & 1)*1+(#a_01_1  & 1)*1) >=1
 
}