Cobaltbaltstrike_RAW_Payload_https_stager_x64

rule Cobaltbaltstrike_RAW_Payload_https_stager_x64
{
  meta:
    author = "Avast Threat Intel Team"
    description = "Detects CobaltStrike payloads"
    reference = "https://github.com/avast/ioc"
    id = "5f9c7426-63be-5049-91fc-63b5c29618bd"
  strings:
    // x64 default eop
    $h01 = { FC 48 83 E4 F0 E8 C8 00 00 00 41 51 41 50 52 51 56 48 31 D2 65 48 8B 52 }
  condition:
    /*
    Payload API list:
    Offset  | Hash value  | API name
    0x00e9  | 0x0726774c  | kernel32.dll_LoadLibraryA
    0x0101  | 0xa779563a  | wininet.dll_InternetOpenA
    0x0123  | 0xc69f8957  | wininet.dll_InternetConnectA
    0x0142  | 0x3b2e55eb  | wininet.dll_HttpOpenRequestA
    0x016c  | 0x869e4675  | wininet.dll_InternetSetOptionA
    0x0186  | 0x7b18062d  | wininet.dll_HttpSendRequestA
    0x032b  | 0x56a2b5f0  | kernel32.dll_ExitProcess
    0x0347  | 0xe553a458  | kernel32.dll_VirtualAlloc
    0x0365  | 0xe2899612  | wininet.dll_InternetReadFile
    */
    uint32(@h01+0x00e9) == 0x0726774c and
    uint32(@h01+0x0101) == 0xa779563a and
    uint32(@h01+0x0123) == 0xc69f8957 and
    uint32(@h01+0x0142) == 0x3b2e55eb and
    uint32(@h01+0x016c) == 0x869e4675 and
    uint32(@h01+0x0186) == 0x7b18062d and
    uint32(@h01+0x032b) == 0x56a2b5f0 and
    uint32(@h01+0x0347) == 0xe553a458 and
    uint32(@h01+0x0365) == 0xe2899612
}