Cobaltbaltstrike_RAW_Payload_http_stager_x64

rule Cobaltbaltstrike_RAW_Payload_http_stager_x64
{
  meta:
    author = "Avast Threat Intel Team"
    description = "Detects CobaltStrike payloads"
    reference = "https://github.com/avast/ioc"
    id = "7eeeb2a1-4903-5649-ae30-fd43367ab468"
  strings:
    // x64 default eop
    $h01 = { FC 48 83 E4 F0 E8 C8 00 00 00 41 51 41 50 52 51 56 48 31 D2 65 48 8B 52 }
  condition:
    /*
    Payload API list:
    Offset  | Hash value  | API name
    0x00e9  | 0x0726774c  | kernel32.dll_LoadLibraryA
    0x0101  | 0xa779563a  | wininet.dll_InternetOpenA
    0x0120  | 0xc69f8957  | wininet.dll_InternetConnectA
    0x013f  | 0x3b2e55eb  | wininet.dll_HttpOpenRequestA
    0x0163  | 0x7b18062d  | wininet.dll_HttpSendRequestA
    0x0308  | 0x56a2b5f0  | kernel32.dll_ExitProcess
    0x0324  | 0xe553a458  | kernel32.dll_VirtualAlloc
    0x0342  | 0xe2899612  | wininet.dll_InternetReadFile
    */
    uint32(@h01+0x00e9) == 0x0726774c and
    uint32(@h01+0x0101) == 0xa779563a and
    uint32(@h01+0x0120) == 0xc69f8957 and
    uint32(@h01+0x013f) == 0x3b2e55eb and
    uint32(@h01+0x0163) == 0x7b18062d and
    uint32(@h01+0x0308) == 0x56a2b5f0 and
    uint32(@h01+0x0324) == 0xe553a458 and
    uint32(@h01+0x0342) == 0xe2899612
}