YARA Detection Rule: Cobaltbaltstrike_Beacon_Encoded
Repository: Neo23x0/signature-base
Detects: Detects CobaltStrike payloads
Author: Avast Threat Intel Team
Reference: https://github.com/avast/ioc

Pattern signatures:
// x86 array
    $s01 = "0x4d, 0x5a, 0xe8, 0x00, 0x00, 0x00, 0x00, 0x5b, 0x89, 0xdf, 0x52, 0x45, 0x55, 0x89, 0xe5, 0x81" ascii wide nocase
    $s02 = "0x4d,0x5a,0xe8,0x00,0x00,0x00,0x00,0x5b,0x89,0xdf,0x52,0x45,0x55,0x89,0xe5,0x81" ascii wide nocase
    // x64 array
    $s03 = "0x4d, 0x5a, 0x41, 0x52, 0x55, 0x48, 0x89, 0xe5, 0x48, 0x81, 0xec, 0x20, 0x00, 0x00, 0x00, 0x48" ascii wide nocase
    $s04 = "0x4d,0x5a,0x41,0x52,0x55,0x48,0x89,0xe5,0x48,0x81,0xec,0x20,0x00,0x00,0x00,0x48" ascii wide nocase
    // x86 hex
    $s05 = "4d5ae[PII_REDACTED]b89df52455589e581" ascii wide nocase
    $s06 = "4d 5a e8 00 00 00 00 5b 89 df 52 45 55 89 e5 81" ascii wide nocase
    // x64 hex
    $s07 = "4d5a[PII_REDACTED]e54881ec[PII_REDACTED]" ascii wide nocase
    $s08 = "4d 5a 41 52 55 48 89 e5 48 81 ec 20 00 00 00 48" ascii wide nocase
    // x86 base64
    $s09 = "TVroAAAAAFuJ31JFVYnlg" ascii wide
    // x64 base64
    $s10 = "TVpBUlVIieVIgewgAAAAS" ascii wide
    // x86 base64 + xor 0x23
    $s11 = "bnnLIyMjI3i

Detection condition:
any of them

Full rule:
rule Cobaltbaltstrike_Beacon_Encoded
{
  meta:
    author = "Avast Threat Intel Team"
    description = "Detects CobaltStrike payloads"
    reference = "https://github.com/avast/ioc"
    id = "497e2a32-015a-5786-a6fa-de7084bfc389"
  strings:
    // x86 array
    $s01 = "0x4d, 0x5a, 0xe8, 0x00, 0x00, 0x00, 0x00, 0x5b, 0x89, 0xdf, 0x52, 0x45, 0x55, 0x89, 0xe5, 0x81" ascii wide nocase
    $s02 = "0x4d,0x5a,0xe8,0x00,0x00,0x00,0x00,0x5b,0x89,0xdf,0x52,0x45,0x55,0x89,0xe5,0x81" ascii wide nocase
    // x64 array
    $s03 = "0x4d, 0x5a, 0x41, 0x52, 0x55, 0x48, 0x89, 0xe5, 0x48, 0x81, 0xec, 0x20, 0x00, 0x00, 0x00, 0x48" ascii wide nocase
    $s04 = "0x4d,0x5a,0x41,0x52,0x55,0x48,0x89,0xe5,0x48,0x81,0xec,0x20,0x00,0x00,0x00,0x48" ascii wide nocase
    // x86 hex
    $s05 = "4d5ae[PII_REDACTED]b89df52455589e581" ascii wide nocase
    $s06 = "4d 5a e8 00 00 00 00 5b 89 df 52 45 55 89 e5 81" ascii wide nocase
    // x64 hex
    $s07 = "4d5a[PII_REDACTED]e54881ec[PII_REDACTED]" ascii wide nocase
    $s08 = "4d 5a 41 52 55 48 89 e5 48 81 ec 20 00 00 00 48" ascii wide nocase
    // x86 base64
    $s09 = "TVroAAAAAFuJ31JFVYnlg" ascii wide
    // x64 base64
    $s10 = "TVpBUlVIieVIgewgAAAAS" ascii wide
    // x86 base64 + xor 0x23
    $s11 = "bnnLIyMjI3iq/HFmdqrGo" ascii wide
    // x64 base64 + xor 0x23
    $s12 = "bnlicXZrqsZros8DIyMja" ascii wide
    // x86 base64 utf16
    $s13 = "TQBaAOgAAAAAAAAAAABbAIkA3wBSAEUAVQCJAOUAg" ascii wide
    // x64 base64 utf16
    $s14 = "TQBaAEEAUgBVAEgAiQDlAEgAgQDsACAAAAAAAAAAS" ascii wide
    // x86 base64 + xor 0x23 utf16
    $s15 = "biN5I2IjcSN2I2sjqiPGI2sjoiPPIwMjIyMjIyMja" ascii wide
    // x64 base64 + xor 0x23 utf16
    $s16 = "biN5I8sjIyMjIyMjIyN4I6oj/CNxI2YjdiOqI8Yjo" ascii wide
    // x86 vba
    $s17 = "Array(77,90,-24,0,0,0,0,91,-119,-33,82,69,85,-119,-27,-127" ascii wide
    $s18 = "Array(77, 90, -24, 0, 0, 0, 0, 91, -119, -33, 82, 69, 85, -119, -27, -127" ascii wide
    // x64 vba
    $s19 = "Array(77,90,65,82,85,72,-119,-27,72,-127,-20,32,0,0