YARA Detection Rule: CobaltStrike_Resources_Covertvpn_injector_Exe_v1_44_to_v2_0_49
Repository: Neo23x0/signature-base
Detects: Cobalt Strike's resources/covertvpn-injector.exe signature for version v1.44 to v2.0.49
Author: gssincla@google.com
Reference: https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse

Pattern signatures:
/*
		C7 04 24 [4]    mov     dword ptr [esp], offset aKernel32; "kernel32"
		E8 [4]          call    GetModuleHandleA
		83 EC 04        sub     esp, 4
		C7 44 24 04 [4] mov     dword ptr [esp+4], offset aIswow64process; "IsWow64Process"
		89 04 24        mov     [esp], eax; hModule
		E8 59 14 00 00  call    GetProcAddress
		83 EC 08        sub     esp, 8
		89 45 ??        mov     [ebp+var_C], eax
		83 7D ?? 00     cmp     [ebp+var_C], 0
		74 ??           jz      short loc_4019BA
		E8 [4]          call    GetCurrentProcess
		8D [2]          lea     edx, [ebp+fIs64bit]
		89 [3]          mov     [esp+4], edx
		89 04 24        mov     [esp], eax
	*/

	$dropComponentsAndActivateDriver_prologue = {
			C7 04 24 [4]
			E8 [4]
			83 EC 04
			C7 44 24 04 [4]
			89 04 24
			E8 59 14 00 00
			83 EC 08
			89 45 ?? 
			83 7D ?? 00 
			74 ?? 
			E8 [4]
			8D [2]
			89 [3]
			89 04 24
		}

	/*
		C7 44 24 04 00 00 00 00 mov     dword ptr [esp+4], 0; AccessMode
		8B [2]                  mov     eax, [eb

Detection condition:
all of them

Full rule:
rule CobaltStrike_Resources_Covertvpn_injector_Exe_v1_44_to_v2_0_49
{
	meta:
		description = "Cobalt Strike's resources/covertvpn-injector.exe signature for version v1.44 to v2.0.49"
		hash =  "d741751520f46602f5a57d1ed49feaa5789115aeeba7fa4fc7cbb534ee335462"
		author = "gssincla@google.com"
		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
		date = "2022-11-18"
		
		id = "48485ae2-1d99-5fa8-b8e8-0047e92ef447"
	strings:
	/*
		C7 04 24 [4]    mov     dword ptr [esp], offset aKernel32; "kernel32"
		E8 [4]          call    GetModuleHandleA
		83 EC 04        sub     esp, 4
		C7 44 24 04 [4] mov     dword ptr [esp+4], offset aIswow64process; "IsWow64Process"
		89 04 24        mov     [esp], eax; hModule
		E8 59 14 00 00  call    GetProcAddress
		83 EC 08        sub     esp, 8
		89 45 ??        mov     [ebp+var_C], eax
		83 7D ?? 00     cmp     [ebp+var_C], 0
		74 ??           jz      short loc_4019BA
		E8 [4]          call    GetCurrentProcess
		8D [2]          lea     edx, [ebp+fIs64bit]
		89 [3]          mov     [esp+4], edx
		89 04 24        mov     [esp], eax
	*/

	$dropComponentsAndActivateDriver_prologue = {
			C7 04 24 [4]
			E8 [4]
			83 EC 04
			C7 44 24 04 [4]
			89 04 24
			E8 59 14 00 00
			83 EC 08
			89 45 ?? 
			83 7D ?? 00 
			74 ?? 
			E8 [4]
			8D [2]
			89 [3]
			89 04 24
		}

	/*
		C7 44 24 04 00 00 00 00 mov     dword ptr [esp+4], 0; AccessMode
		8B [2]                  mov     eax, [ebp+FileName]
		89 ?? 24                mov     [esp], eax; FileName
		E8 [4]                  call    _access
		83 F8 FF                cmp     eax, 0FFFFFFFFh
		74 ??                   jz      short loc_40176D
		8B [2]                  mov     eax, [ebp+FileName]
		89 ?? 24 04             mov     [esp+4], eax
		C7 04 24 [4]            mov     dword ptr [esp], offset aWarningSExists; "Warning: %s exists\n"
		E8 [4]                  call    log
		E9 [4]                  jmp     locret_401871