CobaltStrike_Resources_Artifact64_v3_1_v3_2_v3_14_and_v4_0

rule CobaltStrike_Resources_Artifact64_v3_1_v3_2_v3_14_and_v4_0
{
	meta:
		description = "Cobalt Strike's resources/artifact64{svcbig.exe,.dll,big.dll,svc.exe} and resources/artifactuac(big)64.dll signature for versions 3.14 to 4.x and resources/artifact32svc.exe for 3.14 to 4.x"
		hash =  "2e7a39bd6ac270f8f548855b97c4cef2c2ce7f54c54dd4d1aa0efabeecf3ba90"
		author = "gssincla@google.com"
		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
		date = "2022-11-18"
		
		id = "c9e9b8e0-16fe-5abc-b1fe-0e3e586f6db6"
	strings:
	/*
		31 C0                xor     eax, eax
		EB 0F                jmp     short loc_6BAC16B5
		41 83 E1 03          and     r9d, 3
		47 8A 0C 08          mov     r9b, [r8+r9]
		44 30 0C 01          xor     [rcx+rax], r9b
		48 FF C0             inc     rax
		39 D0                cmp     eax, edx
		41 89 C1             mov     r9d, eax
		7C EA                jl      short loc_6BAC16A6
		4C 8D 05 53 29 00 00 lea     r8, aRundll32Exe; "rundll32.exe"
		E9 D1 FE FF FF       jmp     sub_6BAC1599
	*/

	$decoderFunction = { 31 ?? EB 0F 41 [2] 03 47 [3] 44 [3] 48 [2] 39 ?? 41 [2] 7C EA 4C [6] E9 }

	condition:
		$decoderFunction
}