12 lines
353 B
Plaintext
12 lines
353 B
Plaintext
|
|
rule HackTool_Win32_CobaltStrike_K_{
|
|
meta:
|
|
description = "HackTool:Win32/CobaltStrike.K!!CobaltStrike.K,SIGNATURE_TYPE_ARHSTR_EXT,01 00 01 00 02 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {33 d2 6a 0d 8b c1 5b f7 f3 8a 44 32 0c 30 07 41 } //1
|
|
$a_01_1 = {8b 3b f7 f6 01 cf 41 8a 44 13 0c 30 07 } //1
|
|
condition:
|
|
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=1
|
|
|
|
} |