Execution from Suspicious Stack Trailing Bytes

Description

Identifies execution behavior from known malware or testing tools based on known call stack trailing bytes patterns.

Query · eql

any where event.category in ("library", "api") and
           _arraysearch(process.thread.Ext.call_stack, $entry,
                                                       $entry.callsite_trailing_bytes like
                                                             (/* CBR */
                                                              "4989c54885c00f841002000048c7442438000000004531c94c89*",
                                                              "*4889c24885c00f848b020000b9dedbfe0e4531e4*",
                                                              "837c244004752e4883642428004533c983642420004c8bc333d233c941ffd7488d48ff4883f9fd770c83caff488bc8ff152d1c0000488b8db00100004833cce8",
                                                              "4989c54885c00f849e02000048c7442438000000004531c94c89e2440fb783a4810000c7442430000000004889c1c74424280300000048c744242000000000ff",
                                                              "85c07507b800000000eb07488d05441c00004883c4305dc3554889e54883ec70488*",
                                                              "*4883c4305dc3554889e54883ec7048894d10488b4510c74424200000000041b9*",
                                                              "8b4c244c*4c897424204531c0ba0200000048894424604989c1b902000000ff15*",
                                                              "488b5550488b4d58e8d70700004533ff0fb74b0641ffc44883c728443be17288498bc6eb0233c0488b9c24a00000004883c460415f415e415d415c5f5e5dc3cc",
                                                              /* CNH */
                                                              "85c00f88f300000033c04883c720493bfe*",
                                                              "*85c0752a488d4424304889442420448b4c24304c8b442450488b542448*",
                                                              "4883c448c3000000*8954241048894c24084883ec48e8*",
                                                              "4883c448c3000000*4885c0744065488b0425300000004889442420488b442420*",
                                                              "89442434e9*488b8c2440010000e8*85c0752?488d4424304889442420*",
                                                              "85c07d0eb914000000e8515af9ff32c0eb15837c2450007502eb05e9c2fdffffe9fdfbffffb0014881c4e80000005f5ec3cccc48894c24084883ec38488b4424",
                                                              "85c07c0ac744242001000000eb08c7442420000000008b4424204881c4000500005fc3cccccc40574883ec70488d442458488bf833c0b910000000f3aa48c744",
                                                              "894424548b442454e9c9000000e9bf000000488b442438488944246048c744245804000000c744244400000000488d4424444889442428c7442420400000004c",
                                                              "4889442448eb21e886c9ffff83f8017517488b542430488b8c2440010000e88bfaffff488944244848837c2448007511b918000000e80047f9ff32c0e9fd0600",
                                                              "*741041ffc04883c008443b411872ef33c0*",
                                                              "*4885c07511ffc383fb1472d3eb08488bceffd5*",
                                                              "f7d0c1e81f488b5c2450488b7424584883c4305fc3cc*",
                                                              "f7d0c1e81f85c0????488b5424608b4c2440890a4883c4305bc3cccccc*",
                                                              "4889442448eb21e8*83f8017517488b542430488b8c2440010000e8*488944244848837c2448007511b918000000e8*",
                                                              "c3000000000000000031c065480b40304c8b98100100008b40684989ca41ffe300cccccccc488d0d*",
                                                              "85c0781a33c04503f7498bcff3aa443bf60f8267ffffff448d4001418bd88bc3488b9c24c80000004881c480000000415f415e415d415c5f5e5dc3cccc4885c9",
                                                              "*48895c241048896c2418565741564883ec30448b74247033db498bf9418bf0488bea*",
                                                              "*b0014881c4d80000005f5ec348894c24084883ec38488b442440488b40084863403c488b4c24404803*",
                                                              "*83f803752b488d442430488944242041b9400000004c8b442450488b542448488b8c24300100*",
                                                              "eb248b4424604c8d4c244889442428488d5424404533c0895c2420*",
                                                              "*418b45284c8d442458ba010000004c29e04801c8ffd0eb254189c141c1f91f4183e1704183c110*",
                                                              "e947ffffff418b45284c8d442458ba010000004c29e04801c8ffd0eb254189c141c1f91f4183e1704183c110eb834189c141c1f91f4183e1024183c102e963ff",
                                                              "4889442448eb21e842d1ffff83f8017517488b542430488b8c2400010000e8e7faffff488944244848837c2448007511b918000000e8f8d0ffff32c0e96c0500",
                                                              "f7d0c1e81f488b5c2450488b7424584883c4305fc3cc48895c240848896c241856574154415641574883ec40*",
                                                              /* CCS-1 */
                                                              "4889059a840300bb040000004c8d442468488bc88d5301448bcbff15591d0200488b0d7a8403004c8d4424688d5302448bcbff15411d0200488b058284030048", 
                                                              "*0300eb394533c033d2eb1a4533c0418bd6eb12b920000000e856*", 
                                                              "*0000ba030000004c8bc083642420004533c9488bcbff15*",
                                                              "4889842498000000488b4424388b00488b8c24880000004803c8488bc14889442430488b4424388b4010488b8c24880000004803c8488bc14889442428488b44", 
                                                              "880000004803c8488bc1488b7c2420488bf0b940000000f3a4448b8424a0000000ba40000000488b4c2420e846f3ffff488b4c2420488b842480000000ff5010",
                                                              "0f57c00f11458748c745970700000048c7459f0f000000488b0523e203008945870fb7051de203006689458b0fb60514e2030088458dc6458e00488d4d87e81e",
                                                              "45fc8b4dfc83790c000f842c0100008b55fc8b750c03720c8b7de0b940000000f3a48b4518506a40*",
                                                              "eb09ff7508ff15*5f5ec9c3558bec515133c9390d*",
                                                              "83c40c6a045ae8f297000050ff74241cff742430e8f715000083c40c3bc78944241c7e2eff742418e83e9200003bc7598944241c7e0f8b7c241850e831790000",
                                                              "5feb088b4508e8d819000033c040c9c20c00558bec83ec5457c745c400000000c745bc00000000c745d000000000c745d441414141c745d842424242c745dc00",
                                                              "41837c2404014c8bf8750deb06c6030048ffc3803b0075f58b1f8b77104803dd4803f5eb774885db743048833b007d2a4963473c0fb713428b8c388800000042",
                                                              "eb17448bcb4d8bc7498bd4498bce48897c2420ff15024d01004c8d5c2450498b5b38498b6b40498be3415f415e415c5f5ec3cc48895c240848896c2410488974",
                                                              /* CCS-2 */
                                                              "4831c94831d24d31c04d31c94150415041ba3a5679a7ffd5*",
                                                              "eb16448bcb4d8bc7498bd4498bce897c2420ff15*",
                                                              "*41ba57899fc6ffd5eb595b4889c14831d24989d84d31c95268*",
                                                              "*415141ba57899fc6ffd5eb795b4889c14831d24989d84d31c9526800*",
                                                              "*4d31c9415141516a03415141ba57899fc6ffd5eb*",
                                                              "458b7710458b274c03f34533db4c03e34c8be84d391e0f849c0000004c8b7c24284d85e47439*",
                                                              "489353534889e74889f14889da41b8002000004989f9*",
                                                              "85c0750956e853ffffff59eba38bc65e5bc9c35633f6*",
                                                              "489353534889e74889f14889da41b8002000004989f941ba12*",
                                                              "*904883c4405b5e5f5d415cc39090555756534883ec584531c041b9",
                                                              "*5f5ec9c3558bec515133c9390d*",
                                                              "c9c3ff7508ff15*c9c3558bec51515633f63935*",
                                                              "8b4da84c8d442420894c2428418bd4488b4da048894c24208b4dac894c242c498bceffd34d8bc7*",
                                                              "8b3b4c8bf08b73104803fd4803f5eb*",
                                                              "eb17448bcb4d8bc7498bd4498bce48897c2420ff15024d01004c8d5c2450498b5b38498b6b40498be3415f415e415c5f5ec3cc48895c240848896c2410488974",
                                                              "488bf04883f8ff750733c0e99e00000048895c244048895c2438488d8424580600004889442430488d4424504533c94533c0ba7f740440488bcec7442428f005",
                                                              "4889442430488b842480000000c7401800000200488b842480000000c7806401000001000000488b842480000000c70002000000488b842480000000488b4c24",
                                                              "8945148b55fc8b450c03028945f48b4dfc8b550c0351108955f08b45f08338000f84c8000000837df40074628b4df48b1181e20000008074558b45148b4d1403",
                                                              "8945f48b45f48be55dc3cccccccccc558bec51837d0c007422837d1000761c837d140475168d45fc506a208b4d10518b550c528b45088b4814ffd18be55dc355",
                                                              "488905360b0300bb040000004c8d442468488bc88d5301448bcbff1575ec0100488b0d160b03004c8d4424688d5302448bcbff155dec0100488b0dfe0a030048",
                                                              "488b0d93db02004c63c7488bd6e860930000448b442440488b0d7cdb02004c8d4c24408bd7ff150fb80100b918000000e8358a000048890566db0200e81d7700",
                                                              "41837c2404014c8bf8750deb06c6030048ffc3803b0075f58b1f8b77104803dd4803f5eb774885db743048833b007d2a4963473c0fb713428b8c388800000042",
                                                              "450fb6f6b90100000085c0440f49f1488b4df04885c9740b488b11ff5210488365f000488b4df84885c97406488b11ff5210488b5c2450488b742458488b7c24",
                                                              "b918000000e8358a000048890566db0200e81d770000488b0d5adb0200488901b92a000000e881770000488b0d46db020048894108e899a00000448bc0b80904",
                                                              "458b7710458b274c03f34533db4c03e34c8be84d391e0f849c0000004c8b7c24284d85e4743948b800000000000000804985042474294963453c410fb7142442",
                                                              "4889058fa90300bb040000004c8d442468488bc88d5301448bcbff152e3a0200488b0d6fa903004c8d4424688d5302448bcbff15163a0200488b05bf34030048",
                                                              "8b4d50488bf8488bd833c0f3aa4533db448a4510448b555041bd010000004983c2c044888424b80000004c03d34c895424384584c074088b4538482bd8eb218b",
                                                              "4889c1ebc448c705e90300000000000066418b4500894424544983c5024c896c244831f631c9ba0000100041b80010000041b940000000ff153c0300004889c7",
                                                              "4c8bc885f674204c8bc0482bf833d28bc3ffc3f7f5428a04324232040741880049ffc03bde72e6488b5c2430488b6c2438488b742440488b7c24484883c42041",
                                                              "488b6c24404c8b7c245083c502b8c5735176e93cfdffff3df15c5c3e0f8df80000003de0dfc83b0f8526fdffffe9500100003d3afaff1c0f8d010100003ddecf",
                                                              "4831c94831d24d31c04d31c94150415041ba3a5679a7ffd5eb735a4889c141b8280300004d31c9415141516a03415141ba57899fc6ffd5eb595b4889c14831d2",
                                                              "48894578e9e400000048837d40000f8493000000488b4540488b004885c00f8983000000488b45788b403c4863d0488b45784801d048894510488b4510480588",
                                                              "2fed0db2cd58f89eb8e16ee7f60fb2c04d26348c4e4626b9af354fa66d694a9f1f7fa92233db59a4b2c245267c3bd8352af9f1be8c73151d0a5cfa37d57af026",
                                                              "e69fa6540e4a73b1951a27ad7bc6c06babe52607616bddf0e5b886d4c68f898d945084d97a91d46dc069a3e56eb0f718d1b0bb334501befbc94e7118f881b96c",
                                                              "eb27b92b000000e85ad70000448b0587b7030033d20fb7c033c941b90030000089442420e8a1f4000048890562b703004885c0752dff15ef4502008b1559b703",
                                                              "488905b9b703004885c074d5448b05a5b7030033d2488bc8ff1552460200eb27b92b000000e85ad70000448b0587b7030033d20fb7c033c941b9003000008944",
                                                              "8b4da84c8d442420894c2428418bd4488b4da048894c24208b4dac894c242c498bceffd34d8bc7488d0d15feffffba04000000ffd3488bc3eb0233c04c8d9c24",
                                                              "89442440837c244000740733c0e92601000048c784240801000000000000488b8424100100008b40504889842450010000488b8424000100004889442430c744",
                                                              "8b3b4c8bf88b73104903fe4903f6eb7a4885ff742d48833f007d274963473c0fb717428b8c3888000000428b443910428b4c391c482bd04903cf8b04914903c7",
                                                              "85c00f8898000000488b4c245831d2ff158a1f000085c00f888300*",
                                                              "85c07507b801000000eb304d85f675144c8bcf448bc3498bd7498bccff15*",
                                                              "85c07502eb368b442430050010000089442430*",
                                                              "eb33488b8424e00000004889442420448b8c24d80000004c8b8424d0000000488b9424c8000000488b8c24c0000000ff*",
                                                              "eb16448bcb4d8bc7498bd4498bce897c2420*",
                                                              "89442420837c2420007518488b442458488b00488b00488b4c2458488b09ff5050eb1b4c8b442440*",
                                                              "33c985c00f84f0feffff48395c2438*", "33c985c00f8481feffff8b85340100004839442438*",
                                                              "0fb7450641ffc64883c628443bf0728b488b5c24784883c430415f415e415d415c*",
                                                              "488983100300004885c00f8433ffffff488*",
                                                              "488b5c2460488b6c2468488b7424704883c440415f415e5fc3cccc48895c24084889742410574883ec208b41144963f0488bf92b41103bf0*",
                                                              /* CCS-3 */
                                                              "*b800000000b9??0000004889d7f348ab*",
                                                              "*4153415141504883ec20*",
                                                              "*4151415241534883ec20*",
                                                              "*4152415041534883ec20*",
                                                              "*4883ec20b95bbc4a6aba*",
                                                              "*4883ec20b95d68fa3cba*",
                                                              "*4889d7f348ab*4883ec20*",
                                                              "*488b85e8030000488945c048c745c8*488b85e8030000488945d0*",
                                                              "*89c1488b4578488d9000100000488b85800000004189c84889c1*",
                                                              /* MYHANIB */
                                                              "85c0793ae98f0000004889c1ba5a4ce93be8*48894424684885c07478488b8c2420030000ba8828e950e8*000048894424784885c075a2eb5a488b",
                                                              "ba777791a7488983f00200004889c1e8*488b8bf0020000*48898338020000e8",
                                                               /* CHAV */
                                                              "85c07583488b0e488b01ff5050b8010000004883c4385b5e5f415cc3909090909057534883ec4848c74424300000000048c7442438000000004885c90f84ba00",
                                                              "85c0790d488b13488b92c208000089426831c0b908020000f3aab910000000488d7c2468f3aa488b4c24504885c9740ee8ea5c000048c744245000000000488b",
                                                              "eb094889d9ff90????00004883c4305bc3909090909090905331c04889cb4883ec3048894424204889442428*",
                                                              "e93dffffff8b43284c8d442458ba010000004c29e04801c8ffd04881c4880000005b5e5f5d415c415d415e415fc39090909090909090904989c9*",
                                                              /* dotnut shellcode */
                                                              "eb084c213beb034d213e85c07930498d461033d24c8d8e5406000048894424204c8d864406000033c9ff963801000085c0790b4d217e1033c0e923010000498b",
                                                              "488b5c2470488b7424784883c4605fc3488bc3ebebcccc*",
                                                              /* MP sc */
                                                              "53534889e1535a4d31c04d31c9535349ba041f9dbb00000000ffd54989c4e81a0000003100390032002e003100360038002e0031002e003500350000005a4889",
                                                              /* Qbot */
                                                              "85c0740d508bd78bcbe875ffffff598bf08d45fc50e86f080000595f8bc65e5bc9c353bb0001000053e82efcffff8bd08915041002105985d2750583c8ff5bc3",
                                                              /* sRDI */
                                                              "0fb745064783c6286a205a3bf872816a006a006affff9424c800000083bdc40000000074268b85c00000008b74180c8b0685c0741633ed456a005553ffd08d76",
                                                              /* GPulse */
                                                              "8bcb8bd585ed74182bf30f1f8400000000008a040e8d49018841ff83ea0175f28d44242450ff7424285553ffd7*",
                                                              "8b45e4508b4dac51*83c40c8b45ac998b4dc48981c00c00008991c40c0000c745cc000000008d55cc528b45fc8b4804518b55e8528b45e450ff55a8",
                                                              /* AdC2 */
                                                              "8b53544889c631c04839c2740b8a0c07880c0648ffc0ebf00fb7*",
                                                              "8345e801488b45d80fb740060fb7c03945e8*",
                                                              "488945e048837de000751741b800000000ba00000000b905010000e827*",
                                                              "4889038b45ec4898488d14c500000000488b45204801d0488b004885c07515*",
                                                              "488945d0488b4d10e84c9f000089c2488d85c0fbffff4989d0ba000000004889c1*",
                                                              "488945d0488b05??????00488b55d04889502848837dd0000f8470020000*",
                                                              "48898424100100004883bc241001000000751741b800000000ba00000000b905010000*",
                                                              "4889842430040000488b45104889c1e8????000089c2488d4424204989d0ba000000004889c1*",
                                                              "*488b55e84889501048837de8007422488b45e8*",
                                                              /* DANTE */
                                                              "8bf085c00f89b80000004983feff0f85ae000000488b5510*"
                                                              ))
Raw source Execution from Suspicious Stack Trailing Bytes · Elastic TOML
Esc
Published by elastic/protections-artifacts ↗, licensed under Elastic License 2.0 ↗. Reproduced here unmodified. 
[rule]
description = "Identifies execution behavior from known malware or testing tools based on known call stack trailing bytes patterns."
id = "0a26ccb6-41b9-418d-9314-854aadcb1fba"
license = "Elastic License v2"
name = "Execution from Suspicious Stack Trailing Bytes"
os_list = ["windows"]
version = "1.0.34"

query = '''
any where event.category in ("library", "api") and
           _arraysearch(process.thread.Ext.call_stack, $entry,
                                                       $entry.callsite_trailing_bytes like
                                                             (/* CBR */
                                                              "4989c54885c00f841002000048c7442438000000004531c94c89*",
                                                              "*4889c24885c00f848b020000b9dedbfe0e4531e4*",
                                                              "837c244004752e4883642428004533c983642420004c8bc333d233c941ffd7488d48ff4883f9fd770c83caff488bc8ff152d1c0000488b8db00100004833cce8",
                                                              "4989c54885c00f849e02000048c7442438000000004531c94c89e2440fb783a4810000c7442430000000004889c1c74424280300000048c744242000000000ff",
                                                              "85c07507b800000000eb07488d05441c00004883c4305dc3554889e54883ec70488*",
                                                              "*4883c4305dc3554889e54883ec7048894d10488b4510c74424200000000041b9*",
                                                              "8b4c244c*4c897424204531c0ba0200000048894424604989c1b902000000ff15*",
                                                              "488b5550488b4d58e8d70700004533ff0fb74b0641ffc44883c728443be17288498bc6eb0233c0488b9c24a00000004883c460415f415e415d415c5f5e5dc3cc",
                                                              /* CNH */
                                                              "85c00f88f300000033c04883c720493bfe*",
                                                              "*85c0752a488d4424304889442420448b4c24304c8b442450488b542448*",
                                                              "4883c448c3000000*8954241048894c24084883ec48e8*",
                                                              "4883c448c3000000*4885c0744065488b0425300000004889442420488b442420*",
                                                              "89442434e9*488b8c2440010000e8*85c0752?488d4424304889442420*",
                                                              "85c07d0eb914000000e8515af9ff32c0eb15837c2450007502eb05e9c2fdffffe9fdfbffffb0014881c4e80000005f5ec3cccc48894c24084883ec38488b4424",
                                                              "85c07c0ac744242001000000eb08c7442420000000008b4424204881c4000500005fc3cccccc40574883ec70488d442458488bf833c0b910000000f3aa48c744",
                                                              "894424548b442454e9c9000000e9bf000000488b442438488944246048c744245804000000c744244400000000488d4424444889442428c7442420400000004c",
                                                              "4889442448eb21e886c9ffff83f8017517488b542430488b8c2440010000e88bfaffff488944244848837c2448007511b918000000e80047f9ff32c0e9fd0600",
                                                              "*741041ffc04883c008443b411872ef33c0*",
                                                              "*4885c07511ffc383fb1472d3eb08488bceffd5*",
                                                              "f7d0c1e81f488b5c2450488b7424584883c4305fc3cc*",
                                                              "f7d0c1e81f85c0????488b5424608b4c2440890a4883c4305bc3cccccc*",
                                                              "4889442448eb21e8*83f8017517488b542430488b8c2440010000e8*488944244848837c2448007511b918000000e8*",
                                                              "c3000000000000000031c065480b40304c8b98100100008b40684989ca41ffe300cccccccc488d0d*",
                                                              "85c0781a33c04503f7498bcff3aa443bf60f8267ffffff448d4001418bd88bc3488b9c24c80000004881c480000000415f415e415d415c5f5e5dc3cccc4885c9",
                                                              "*48895c241048896c2418565741564883ec30448b74247033db498bf9418bf0488bea*",
                                                              "*b0014881c4d80000005f5ec348894c24084883ec38488b442440488b40084863403c488b4c24404803*",
                                                              "*83f803752b488d442430488944242041b9400000004c8b442450488b542448488b8c24300100*",
                                                              "eb248b4424604c8d4c244889442428488d5424404533c0895c2420*",
                                                              "*418b45284c8d442458ba010000004c29e04801c8ffd0eb254189c141c1f91f4183e1704183c110*",
                                                              "e947ffffff418b45284c8d442458ba010000004c29e04801c8ffd0eb254189c141c1f91f4183e1704183c110eb834189c141c1f91f4183e1024183c102e963ff",
                                                              "4889442448eb21e842d1ffff83f8017517488b542430488b8c2400010000e8e7faffff488944244848837c2448007511b918000000e8f8d0ffff32c0e96c0500",
                                                              "f7d0c1e81f488b5c2450488b7424584883c4305fc3cc48895c240848896c241856574154415641574883ec40*",
                                                              /* CCS-1 */
                                                              "4889059a840300bb040000004c8d442468488bc88d5301448bcbff15591d0200488b0d7a8403004c8d4424688d5302448bcbff15411d0200488b058284030048", 
                                                              "*0300eb394533c033d2eb1a4533c0418bd6eb12b920000000e856*", 
                                                              "*0000ba030000004c8bc083642420004533c9488bcbff15*",
                                                              "4889842498000000488b4424388b00488b8c24880000004803c8488bc14889442430488b4424388b4010488b8c24880000004803c8488bc14889442428488b44", 
                                                              "880000004803c8488bc1488b7c2420488bf0b940000000f3a4448b8424a0000000ba40000000488b4c2420e846f3ffff488b4c2420488b842480000000ff5010",
                                                              "0f57c00f11458748c745970700000048c7459f0f000000488b0523e203008945870fb7051de203006689458b0fb60514e2030088458dc6458e00488d4d87e81e",
                                                              "45fc8b4dfc83790c000f842c0100008b55fc8b750c03720c8b7de0b940000000f3a48b4518506a40*",
                                                              "eb09ff7508ff15*5f5ec9c3558bec515133c9390d*",
                                                              "83c40c6a045ae8f297000050ff74241cff742430e8f715000083c40c3bc78944241c7e2eff742418e83e9200003bc7598944241c7e0f8b7c241850e831790000",
                                                              "5feb088b4508e8d819000033c040c9c20c00558bec83ec5457c745c400000000c745bc00000000c745d000000000c745d441414141c745d842424242c745dc00",
                                                              "41837c2404014c8bf8750deb06c6030048ffc3803b0075f58b1f8b77104803dd4803f5eb774885db743048833b007d2a4963473c0fb713428b8c388800000042",
                                                              "eb17448bcb4d8bc7498bd4498bce48897c2420ff15024d01004c8d5c2450498b5b38498b6b40498be3415f415e415c5f5ec3cc48895c240848896c2410488974",
                                                              /* CCS-2 */
                                                              "4831c94831d24d31c04d31c94150415041ba3a5679a7ffd5*",
                                                              "eb16448bcb4d8bc7498bd4498bce897c2420ff15*",
                                                              "*41ba57899fc6ffd5eb595b4889c14831d24989d84d31c95268*",
                                                              "*415141ba57899fc6ffd5eb795b4889c14831d24989d84d31c9526800*",
                                                              "*4d31c9415141516a03415141ba57899fc6ffd5eb*",
                                                              "458b7710458b274c03f34533db4c03e34c8be84d391e0f849c0000004c8b7c24284d85e47439*",
                                                              "489353534889e74889f14889da41b8002000004989f9*",
                                                              "85c0750956e853ffffff59eba38bc65e5bc9c35633f6*",
                                                              "489353534889e74889f14889da41b8002000004989f941ba12*",
                                                              "*904883c4405b5e5f5d415cc39090555756534883ec584531c041b9",
                                                              "*5f5ec9c3558bec515133c9390d*",
                                                              "c9c3ff7508ff15*c9c3558bec51515633f63935*",
                                                              "8b4da84c8d442420894c2428418bd4488b4da048894c24208b4dac894c242c498bceffd34d8bc7*",
                                                              "8b3b4c8bf08b73104803fd4803f5eb*",
                                                              "eb17448bcb4d8bc7498bd4498bce48897c2420ff15024d01004c8d5c2450498b5b38498b6b40498be3415f415e415c5f5ec3cc48895c240848896c2410488974",
                                                              "488bf04883f8ff750733c0e99e00000048895c244048895c2438488d8424580600004889442430488d4424504533c94533c0ba7f740440488bcec7442428f005",
                                                              "4889442430488b842480000000c7401800000200488b842480000000c7806401000001000000488b842480000000c70002000000488b842480000000488b4c24",
                                                              "8945148b55fc8b450c03028945f48b4dfc8b550c0351108955f08b45f08338000f84c8000000837df40074628b4df48b1181e20000008074558b45148b4d1403",
                                                              "8945f48b45f48be55dc3cccccccccc558bec51837d0c007422837d1000761c837d140475168d45fc506a208b4d10518b550c528b45088b4814ffd18be55dc355",
                                                              "488905360b0300bb040000004c8d442468488bc88d5301448bcbff1575ec0100488b0d160b03004c8d4424688d5302448bcbff155dec0100488b0dfe0a030048",
                                                              "488b0d93db02004c63c7488bd6e860930000448b442440488b0d7cdb02004c8d4c24408bd7ff150fb80100b918000000e8358a000048890566db0200e81d7700",
                                                              "41837c2404014c8bf8750deb06c6030048ffc3803b0075f58b1f8b77104803dd4803f5eb774885db743048833b007d2a4963473c0fb713428b8c388800000042",
                                                              "450fb6f6b90100000085c0440f49f1488b4df04885c9740b488b11ff5210488365f000488b4df84885c97406488b11ff5210488b5c2450488b742458488b7c24",
                                                              "b918000000e8358a000048890566db0200e81d770000488b0d5adb0200488901b92a000000e881770000488b0d46db020048894108e899a00000448bc0b80904",
                                                              "458b7710458b274c03f34533db4c03e34c8be84d391e0f849c0000004c8b7c24284d85e4743948b800000000000000804985042474294963453c410fb7142442",
                                                              "4889058fa90300bb040000004c8d442468488bc88d5301448bcbff152e3a0200488b0d6fa903004c8d4424688d5302448bcbff15163a0200488b05bf34030048",
                                                              "8b4d50488bf8488bd833c0f3aa4533db448a4510448b555041bd010000004983c2c044888424b80000004c03d34c895424384584c074088b4538482bd8eb218b",
                                                              "4889c1ebc448c705e90300000000000066418b4500894424544983c5024c896c244831f631c9ba0000100041b80010000041b940000000ff153c0300004889c7",
                                                              "4c8bc885f674204c8bc0482bf833d28bc3ffc3f7f5428a04324232040741880049ffc03bde72e6488b5c2430488b6c2438488b742440488b7c24484883c42041",
                                                              "488b6c24404c8b7c245083c502b8c5735176e93cfdffff3df15c5c3e0f8df80000003de0dfc83b0f8526fdffffe9500100003d3afaff1c0f8d010100003ddecf",
                                                              "4831c94831d24d31c04d31c94150415041ba3a5679a7ffd5eb735a4889c141b8280300004d31c9415141516a03415141ba57899fc6ffd5eb595b4889c14831d2",
                                                              "48894578e9e400000048837d40000f8493000000488b4540488b004885c00f8983000000488b45788b403c4863d0488b45784801d048894510488b4510480588",
                                                              "2fed0db2cd58f89eb8e16ee7f60fb2c04d26348c4e4626b9af354fa66d694a9f1f7fa92233db59a4b2c245267c3bd8352af9f1be8c73151d0a5cfa37d57af026",
                                                              "e69fa6540e4a73b1951a27ad7bc6c06babe52607616bddf0e5b886d4c68f898d945084d97a91d46dc069a3e56eb0f718d1b0bb334501befbc94e7118f881b96c",
                                                              "eb27b92b000000e85ad70000448b0587b7030033d20fb7c033c941b90030000089442420e8a1f4000048890562b703004885c0752dff15ef4502008b1559b703",
                                                              "488905b9b703004885c074d5448b05a5b7030033d2488bc8ff1552460200eb27b92b000000e85ad70000448b0587b7030033d20fb7c033c941b9003000008944",
                                                              "8b4da84c8d442420894c2428418bd4488b4da048894c24208b4dac894c242c498bceffd34d8bc7488d0d15feffffba04000000ffd3488bc3eb0233c04c8d9c24",
                                                              "89442440837c244000740733c0e92601000048c784240801000000000000488b8424100100008b40504889842450010000488b8424000100004889442430c744",
                                                              "8b3b4c8bf88b73104903fe4903f6eb7a4885ff742d48833f007d274963473c0fb717428b8c3888000000428b443910428b4c391c482bd04903cf8b04914903c7",
                                                              "85c00f8898000000488b4c245831d2ff158a1f000085c00f888300*",
                                                              "85c07507b801000000eb304d85f675144c8bcf448bc3498bd7498bccff15*",
                                                              "85c07502eb368b442430050010000089442430*",
                                                              "eb33488b8424e00000004889442420448b8c24d80000004c8b8424d0000000488b9424c8000000488b8c24c0000000ff*",
                                                              "eb16448bcb4d8bc7498bd4498bce897c2420*",
                                                              "89442420837c2420007518488b442458488b00488b00488b4c2458488b09ff5050eb1b4c8b442440*",
                                                              "33c985c00f84f0feffff48395c2438*", "33c985c00f8481feffff8b85340100004839442438*",
                                                              "0fb7450641ffc64883c628443bf0728b488b5c24784883c430415f415e415d415c*",
                                                              "488983100300004885c00f8433ffffff488*",
                                                              "488b5c2460488b6c2468488b7424704883c440415f415e5fc3cccc48895c24084889742410574883ec208b41144963f0488bf92b41103bf0*",
                                                              /* CCS-3 */
                                                              "*b800000000b9??0000004889d7f348ab*",
                                                              "*4153415141504883ec20*",
                                                              "*4151415241534883ec20*",
                                                              "*4152415041534883ec20*",
                                                              "*4883ec20b95bbc4a6aba*",
                                                              "*4883ec20b95d68fa3cba*",
                                                              "*4889d7f348ab*4883ec20*",
                                                              "*488b85e8030000488945c048c745c8*488b85e8030000488945d0*",
                                                              "*89c1488b4578488d9000100000488b85800000004189c84889c1*",
                                                              /* MYHANIB */
                                                              "85c0793ae98f0000004889c1ba5a4ce93be8*48894424684885c07478488b8c2420030000ba8828e950e8*000048894424784885c075a2eb5a488b",
                                                              "ba777791a7488983f00200004889c1e8*488b8bf0020000*48898338020000e8",
                                                               /* CHAV */
                                                              "85c07583488b0e488b01ff5050b8010000004883c4385b5e5f415cc3909090909057534883ec4848c74424300000000048c7442438000000004885c90f84ba00",
                                                              "85c0790d488b13488b92c208000089426831c0b908020000f3aab910000000488d7c2468f3aa488b4c24504885c9740ee8ea5c000048c744245000000000488b",
                                                              "eb094889d9ff90????00004883c4305bc3909090909090905331c04889cb4883ec3048894424204889442428*",
                                                              "e93dffffff8b43284c8d442458ba010000004c29e04801c8ffd04881c4880000005b5e5f5d415c415d415e415fc39090909090909090904989c9*",
                                                              /* dotnut shellcode */
                                                              "eb084c213beb034d213e85c07930498d461033d24c8d8e5406000048894424204c8d864406000033c9ff963801000085c0790b4d217e1033c0e923010000498b",
                                                              "488b5c2470488b7424784883c4605fc3488bc3ebebcccc*",
                                                              /* MP sc */
                                                              "53534889e1535a4d31c04d31c9535349ba041f9dbb00000000ffd54989c4e81a0000003100390032002e003100360038002e0031002e003500350000005a4889",
                                                              /* Qbot */
                                                              "85c0740d508bd78bcbe875ffffff598bf08d45fc50e86f080000595f8bc65e5bc9c353bb0001000053e82efcffff8bd08915041002105985d2750583c8ff5bc3",
                                                              /* sRDI */
                                                              "0fb745064783c6286a205a3bf872816a006a006affff9424c800000083bdc40000000074268b85c00000008b74180c8b0685c0741633ed456a005553ffd08d76",
                                                              /* GPulse */
                                                              "8bcb8bd585ed74182bf30f1f8400000000008a040e8d49018841ff83ea0175f28d44242450ff7424285553ffd7*",
                                                              "8b45e4508b4dac51*83c40c8b45ac998b4dc48981c00c00008991c40c0000c745cc000000008d55cc528b45fc8b4804518b55e8528b45e450ff55a8",
                                                              /* AdC2 */
                                                              "8b53544889c631c04839c2740b8a0c07880c0648ffc0ebf00fb7*",
                                                              "8345e801488b45d80fb740060fb7c03945e8*",
                                                              "488945e048837de000751741b800000000ba00000000b905010000e827*",
                                                              "4889038b45ec4898488d14c500000000488b45204801d0488b004885c07515*",
                                                              "488945d0488b4d10e84c9f000089c2488d85c0fbffff4989d0ba000000004889c1*",
                                                              "488945d0488b05??????00488b55d04889502848837dd0000f8470020000*",
                                                              "48898424100100004883bc241001000000751741b800000000ba00000000b905010000*",
                                                              "4889842430040000488b45104889c1e8????000089c2488d4424204989d0ba000000004889c1*",
                                                              "*488b55e84889501048837de8007422488b45e8*",
                                                              /* DANTE */
                                                              "8bf085c00f89b80000004983feff0f85ae000000488b5510*"
                                                              ))
'''

min_endpoint_version = "8.8.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"

[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[internal]
min_endpoint_version = "8.8.0"

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.