Cobaltbaltstrike_RAW_Payload_TCP_Reverse_x86

rule Cobaltbaltstrike_RAW_Payload_TCP_Reverse_x86
{
  meta:
    author = "Avast Threat Intel Team"
    description = "Detects CobaltStrike payloads"
    reference = "https://github.com/avast/ioc"
    id = "ac824189-614d-5bff-9bbb-a4244cace563"
  strings:
    // x86 default eop
    $h01 = { FC E8 89 00 00 00 60 89 E5 31 D2 64 8B 52 30 8B 52 0C 8B 52 14 8B 72 28 }
  condition:
    /*
    Payload API list:
    Offset  | Hash value  | API name
    0x009c  | 0x0726774c  | kernel32.dll_LoadLibraryA
    0x00ac  | 0x006b8029  | ws2_32.dll_WSAStartup
    0x00bb  | 0xe0df0fea  | ws2_32.dll_WSASocketA
    0x00d5  | 0x6174a599  | ws2_32.dll_connect
    0x00e5  | 0x56a2b5f0  | kernel32.dll_ExitProcess
    0x00f2  | 0x5fc8d902  | ws2_32.dll_recv
    0x0105  | 0xe553a458  | kernel32.dll_VirtualAlloc
    0x0113  | 0x5fc8d902  | ws2_32.dll_recv
    */
    uint32(@h01+0x009c) == 0x0726774c and
    uint32(@h01+0x00ac) == 0x006b8029 and
    uint32(@h01+0x00bb) == 0xe0df0fea and
    uint32(@h01+0x00d5) == 0x6174a599 and
    uint32(@h01+0x00e5) == 0x56a2b5f0 and
    uint32(@h01+0x00f2) == 0x5fc8d902 and
    uint32(@h01+0x0105) == 0xe553a458 and
    uint32(@h01+0x0113) == 0x5fc8d902
}