Cobaltbaltstrike_RAW_Payload_smb_stager_x86

rule Cobaltbaltstrike_RAW_Payload_smb_stager_x86
{
  meta:
    author = "Avast Threat Intel Team"
    description = "Detects CobaltStrike payloads"
    reference = "https://github.com/avast/ioc"
    id = "29911a14-08ea-54de-9c07-630c6516bd49"
  strings:
    // x86 default eop
    $h01 = { FC E8 89 00 00 00 60 89 E5 31 D2 64 8B 52 30 8B 52 0C 8B 52 14 8B 72 28 }
  condition:
    /*
    Payload API list:
    Offset  | Hash value  | API name
    0x00a1  | 0xe553a458  | kernel32.dll_VirtualAlloc
    0x00c4  | 0xd4df7045  | kernel32.dll_CreateNamedPipeA
    0x00d2  | 0xe27d6f28  | kernel32.dll_ConnectNamedPipe
    0x00f8  | 0xbb5f9ead  | kernel32.dll_ReadFile
    0x010d  | 0xbb5f9ead  | kernel32.dll_ReadFile
    0x0131  | 0xfcddfac0  | kernel32.dll_DisconnectNamedPipe
    0x0139  | 0x528796c6  | kernel32.dll_CloseHandle
    0x014b  | 0x56a2b5f0  | kernel32.dll_ExitProcess
    */
    uint32(@h01+0x00a1) == 0xe553a458 and
    uint32(@h01+0x00c4) == 0xd4df7045 and
    uint32(@h01+0x00d2) == 0xe27d6f28 and
    uint32(@h01+0x00f8) == 0xbb5f9ead and
    uint32(@h01+0x010d) == 0xbb5f9ead and
    uint32(@h01+0x0131) == 0xfcddfac0 and
    uint32(@h01+0x0139) == 0x528796c6 and
    uint32(@h01+0x014b) == 0x56a2b5f0
}