deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: WannaCry_Ransomware
Repository: Neo23x0/signature-base
Detects: Detects WannaCry Ransomware
Author: Florian Roth (Nextron Systems) (with the help of binar.ly)
Reference: https://goo.gl/HG2j5T

Pattern signatures:
$x1 = "icacls . /grant Everyone:F /T /C /Q" fullword ascii
      $x2 = "taskdl.exe" fullword ascii
      $x3 = "tasksche.exe" fullword ascii
      $x4 = "Global\\MsWinZonesCacheCounterMutexA" fullword ascii
      $x5 = "WNcry@2ol7" fullword ascii
      $x6 = "www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com" ascii
      $x7 = "mssecsvc.exe" fullword ascii
      $x8 = "C:\\%s\\qeriuwjhrf" fullword ascii
      $x9 = "icacls . /grant Everyone:F /T /C /Q" fullword ascii

      $s1 = "C:\\%s\\%s" fullword ascii
      $s2 = "<!-- Windows 10 --> " fullword ascii
      $s3 = "cmd.exe /c \"%s\"" fullword ascii
      $s4 = "msg/m_portuguese.wnry" fullword ascii
      $s5 = "\\\\192.168.56.20\\IPC$" fullword wide
      $s6 = "\\\\172.16.99.5\\IPC$" fullword wide

      $op1 = { 10 ac 72 0d 3d ff ff 1f ac 77 06 b8 01 00 00 00 }
      $op2 = { 44 24 64 8a c6 44 24 65 0e c6 44 24 66 80 c6 44 }
      $op3 = { 18 df 6c 24 14 dc 64 24 2c dc 6c 24 5c dc 15 88 }
      $op4 = { 09 ff 76 30 50 ff 56 2c 59

Detection condition:
uint16(0) == 0x5a4d and filesize < 10000KB and ( 1 of ($x*) and 1 of ($s*) or 3 of ($op*) )

Full rule:
rule WannaCry_Ransomware {
   meta:
      description = "Detects WannaCry Ransomware"
      author = "Florian Roth (Nextron Systems) (with the help of binar.ly)"
      reference = "https://goo.gl/HG2j5T"
      date = "2017-05-12"
      hash1 = "ed01ebfbc9eb5bbea545af4d01bf5f[PII_REDACTED]80439c6e5babe8e080e41aa"
      id = "2e46b4db-8c94-53ed-ae27-31dd37b04940"
   strings:
      $x1 = "icacls . /grant Everyone:F /T /C /Q" fullword ascii
      $x2 = "taskdl.exe" fullword ascii
      $x3 = "tasksche.exe" fullword ascii
      $x4 = "Global\\MsWinZonesCacheCounterMutexA" fullword ascii
      $x5 = "WNcry@2ol7" fullword ascii
      $x6 = "www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com" ascii
      $x7 = "mssecsvc.exe" fullword ascii
      $x8 = "C:\\%s\\qeriuwjhrf" fullword ascii
      $x9 = "icacls . /grant Everyone:F /T /C /Q" fullword ascii

      $s1 = "C:\\%s\\%s" fullword ascii
      $s2 = "<!-- Windows 10 --> " fullword ascii
      $s3 = "cmd.exe /c \"%s\"" fullword ascii
      $s4 = "msg/m_portuguese.wnry" fullword ascii
      $s5 = "\\\\192.168.56.20\\IPC$" fullword wide
      $s6 = "\\\\172.16.99.5\\IPC$" fullword wide

      $op1 = { 10 ac 72 0d 3d ff ff 1f ac 77 06 b8 01 00 00 00 }
      $op2 = { 44 24 64 8a c6 44 24 65 0e c6 44 24 66 80 c6 44 }
      $op3 = { 18 df 6c 24 14 dc 64 24 2c dc 6c 24 5c dc 15 88 }
      $op4 = { 09 ff 76 30 50 ff 56 2c 59 59 47 3b 7e 0c 7c }
      $op5 = { c1 ea 1d c1 ee 1e 83 e2 01 83 e6 01 8d 14 56 }
      $op6 = { 8d 48 ff f7 d1 8d 44 10 ff 23 f1 23 c1 }
   condition:
      uint16(0) == 0x5a4d and filesize < 10000KB and ( 1 of ($x*) and 1 of ($s*) or 3 of ($op*) )
}
YARA Detection Rule: WannaCry_Ransomware_Gen
Repository: Neo23x0/signature-base
Detects: Detects WannaCry Ransomware
Author: Florian Roth (Nextron Systems) (based on rule by US CERT)
Reference: https://www.us-cert.gov/ncas/alerts/TA17-132A

Pattern signatures:
$s1 = "__TREEID__PLACEHOLDER__" ascii
      $s2 = "__USERID__PLACEHOLDER__" ascii
      $s3 = "Windows for Workgroups 3.1a" fullword ascii
      $s4 = "PC NETWORK PROGRAM 1.0" fullword ascii
      $s5 = "LANMAN1.0" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 5000KB and all of them

Full rule:
rule WannaCry_Ransomware_Gen {
   meta:
      description = "Detects WannaCry Ransomware"
      author = "Florian Roth (Nextron Systems) (based on rule by US CERT)"
      reference = "https://www.us-cert.gov/ncas/alerts/TA17-132A"
      date = "2017-05-12"
      hash1 = "9fe91d542952e145f2244572f314632d93eb1e[PII_REDACTED]b2ca7f7df2b0cb05"
      hash2 = "8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df"
      hash3 = "4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359"
      id = "d28d3d76-9c24-5476-9a0c-936c17477d6a"
   strings:
      $s1 = "__TREEID__PLACEHOLDER__" ascii
      $s2 = "__USERID__PLACEHOLDER__" ascii
      $s3 = "Windows for Workgroups 3.1a" fullword ascii
      $s4 = "PC NETWORK PROGRAM 1.0" fullword ascii
      $s5 = "LANMAN1.0" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 5000KB and all of them
}
YARA Detection Rule: WannCry_m_vbs
Repository: Neo23x0/signature-base
Detects: Detects WannaCry Ransomware VBS
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/HG2j5T

Pattern signatures:
$x1 = ".TargetPath = \"C:\\@" ascii
      $x2 = ".CreateShortcut(\"C:\\@" ascii
      $s3 = " = WScript.CreateObject(\"WScript.Shell\")" ascii

Detection condition:
( uint16(0) == 0x4553 and filesize < 1KB and all of them )

Full rule:
rule WannCry_m_vbs {
   meta:
      description = "Detects WannaCry Ransomware VBS"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/HG2j5T"
      date = "2017-05-12"
      hash1 = "51432d3196d9b78bdc9867a77d601caffd4adaa66dcac944a5ba0b3112bbea3b"
      id = "a8f13bd2-984d-5c8c-ac53-7d442e222850"
   strings:
      $x1 = ".TargetPath = \"C:\\@" ascii
      $x2 = ".CreateShortcut(\"C:\\@" ascii
      $s3 = " = WScript.CreateObject(\"WScript.Shell\")" ascii
   condition:
      ( uint16(0) == 0x4553 and filesize < 1KB and all of them )
}
YARA Detection Rule: WannCry_BAT
Repository: Neo23x0/signature-base
Detects: Detects WannaCry Ransomware BATCH File
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/HG2j5T

Pattern signatures:
$s1 = "@.exe\">> m.vbs" ascii
      $s2 = "cscript.exe //nologo m.vbs" fullword ascii
      $s3 = "echo SET ow = WScript.CreateObject(\"WScript.Shell\")> " ascii
      $s4 = "echo om.Save>> m.vbs" fullword ascii

Detection condition:
( uint16(0) == 0x6540 and filesize < 1KB and 1 of them )

Full rule:
rule WannCry_BAT {
   meta:
      description = "Detects WannaCry Ransomware BATCH File"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/HG2j5T"
      date = "2017-05-12"
      hash1 = "f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077"
      id = "0929f0de-28ac-5534-a6fd-7b131abda011"
   strings:
      $s1 = "@.exe\">> m.vbs" ascii
      $s2 = "cscript.exe //nologo m.vbs" fullword ascii
      $s3 = "echo SET ow = WScript.CreateObject(\"WScript.Shell\")> " ascii
      $s4 = "echo om.Save>> m.vbs" fullword ascii
   condition:
      ( uint16(0) == 0x6540 and filesize < 1KB and 1 of them )
}
YARA Detection Rule: WannaCry_RansomNote
Repository: Neo23x0/signature-base
Detects: Detects WannaCry Ransomware Note
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/HG2j5T

Pattern signatures:
$s1 = "A:  Don't worry about decryption." fullword ascii
      $s2 = "Q:  What's wrong with my files?" fullword ascii

Detection condition:
( uint16(0) == 0x3a51 and filesize < 2KB and all of them )

Full rule:
rule WannaCry_RansomNote {
   meta:
      description = "Detects WannaCry Ransomware Note"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/HG2j5T"
      date = "2017-05-12"
      hash1 = "4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e"
      id = "65ce8faf-0981-5382-bc15-f094ccaa9f54"
   strings:
      $s1 = "A:  Don't worry about decryption." fullword ascii
      $s2 = "Q:  What's wrong with my files?" fullword ascii
   condition:
      ( uint16(0) == 0x3a51 and filesize < 2KB and all of them )
}
YARA Detection Rule: APT_lazaruswannacry
Repository: Neo23x0/signature-base
Detects: Rule based on shared code between Feb 2017 Wannacry sample and Lazarus backdoor from Feb 2015 discovered by Neel Mehta
Author: Costin G. Raiu, Kaspersky Lab
Reference: https://twitter.com/neelmehta/status/[PII_REDACTED]16225536

Pattern signatures:
$a1 = { 51 53 55 8B 6C 24 10 56 57 6A 20 8B 45 00 8D 75
         04 24 01 0C 01 46 89 45 00 C6 46 FF 03 C6 06 01 46
         56 E8 }
      $a2 = { 03 00 04 00 05 00 06 00 08 00 09 00 0A 00 0D 00
         10 00 11 00 12 00 13 00 14 00 15 00 16 00 2F 00
         30 00 31 00 32 00 33 00 34 00 35 00 36 00 37 00
         38 00 39 00 3C 00 3D 00 3E 00 3F 00 40 00 41 00
         44 00 45 00 46 00 62 00 63 00 64 00 66 00 67 00
         68 00 69 00 6A 00 6B 00 84 00 87 00 88 00 96 00
         FF 00 01 C0 02 C0 03 C0 04 C0 05 C0 06 C0 07 C0
         08 C0 09 C0 0A C0 0B C0 0C C0 0D C0 0E C0 0F C0
         10 C0 11 C0 12 C0 13 C0 14 C0 23 C0 24 C0 27 C0
         2B C0 2C C0 FF FE }

Detection condition:
uint16(0) == 0x5A4D and filesize < 15000000 and all of them

Full rule:
rule APT_lazaruswannacry {
   meta:
      description = "Rule based on shared code between Feb 2017 Wannacry sample and Lazarus backdoor from Feb 2015 discovered by Neel Mehta"
      date = "2017-05-15"
      reference = "https://twitter.com/neelmehta/status/[PII_REDACTED]16225536"
      author = "Costin G. Raiu, Kaspersky Lab"
      version = "1.0"
      hash = "9c7c7149387a1c79679a87dd1ba755bc"
      hash = "ac21c8ad899727137c4b94458d7aa8d8"
      id = "e9dd9750-2366-503a-a879-972dbead6bf3"
   strings:
      $a1 = { 51 53 55 8B 6C 24 10 56 57 6A 20 8B 45 00 8D 75
         04 24 01 0C 01 46 89 45 00 C6 46 FF 03 C6 06 01 46
         56 E8 }
      $a2 = { 03 00 04 00 05 00 06 00 08 00 09 00 0A 00 0D 00
         10 00 11 00 12 00 13 00 14 00 15 00 16 00 2F 00
         30 00 31 00 32 00 33 00 34 00 35 00 36 00 37 00
         38 00 39 00 3C 00 3D 00 3E 00 3F 00 40 00 41 00
         44 00 45 00 46 00 62 00 63 00 64 00 66 00 67 00
         68 00 69 00 6A 00 6B 00 84 00 87 00 88 00 96 00
         FF 00 01 C0 02 C0 03 C0 04 C0 05 C0 06 C0 07 C0
         08 C0 09 C0 0A C0 0B C0 0C C0 0D C0 0E C0 0F C0
         10 C0 11 C0 12 C0 13 C0 14 C0 23 C0 24 C0 27 C0
         2B C0 2C C0 FF FE }
   condition:
      uint16(0) == 0x5A4D and filesize < 15000000 and all of them
}
YARA Detection Rule: REGEORG_Tuneller_generic
Repository: Neo23x0/signature-base
Author: Mandiant
Reference: https://www.mandiant.com/resources/unc3524-eye-spy-email

Pattern signatures:
$s1 = "System.Net.IPEndPoint"
        $s2 = "Response.AddHeader"
        $s3 = "Request.InputStream.Read"
        $s4 = "Request.Headers.Get"
        $s5 = "Response.Write"
        $s6 = "System.Buffer.BlockCopy"
        $s7 = "Response.BinaryWrite"
        $s8 = "SocketException soex"

Detection condition:
filesize < 1MB and 7 of them

Full rule:
rule REGEORG_Tuneller_generic {
    meta:
        author = "Mandiant"
        date = "2021-12-20"
        date_modified = "2021-12-20"
        hash = "ba22992ce835dadcd06bff4ab7b162f9"
        reference = "https://www.mandiant.com/resources/unc3524-eye-spy-email"
        id = "a87979b7-2732-5a32-b3f3-a815a58b6589"
    strings:
        $s1 = "System.Net.IPEndPoint"
        $s2 = "Response.AddHeader"
        $s3 = "Request.InputStream.Read"
        $s4 = "Request.Headers.Get"
        $s5 = "Response.Write"
        $s6 = "System.Buffer.BlockCopy"
        $s7 = "Response.BinaryWrite"
        $s8 = "SocketException soex"
    condition:
        filesize < 1MB and 7 of them
}
YARA Detection Rule: Cobaltbaltstrike_RAW_Payload_dns_stager_x86
Repository: Neo23x0/signature-base
Detects: Detects CobaltStrike payloads
Author: Avast Threat Intel Team
Reference: https://github.com/avast/ioc

Pattern signatures:
// x86 default eop
    $h01 = { FC E8 89 00 00 00 60 89 E5 31 D2 64 8B 52 30 8B 52 0C 8B 52 14 8B 72 28 }

Detection condition:
/*
    Payload API list:
    Offset  | Hash value  | API name
    0x00a3  | 0xe553a458  | kernel32.dll_VirtualAlloc
    0x00bd  | 0x0726774c  | kernel32.dll_LoadLibraryA
    0x012f  | 0xc99cc96a  | dnsapi.dll_DnsQuery_A
    0x0198  | 0x56a2b5f0  | kernel32.dll_ExitProcess
    0x01a4  | 0xe035f044  |

Full rule:
rule Cobaltbaltstrike_RAW_Payload_dns_stager_x86
{
  meta:
    author = "Avast Threat Intel Team"
    description = "Detects CobaltStrike payloads"
    reference = "https://github.com/avast/ioc"
    id = "817c4a72-7be1-5a58-987d-fe203d7778ea"
  strings:
    // x86 default eop
    $h01 = { FC E8 89 00 00 00 60 89 E5 31 D2 64 8B 52 30 8B 52 0C 8B 52 14 8B 72 28 }
  condition:
    /*
    Payload API list:
    Offset  | Hash value  | API name
    0x00a3  | 0xe553a458  | kernel32.dll_VirtualAlloc
    0x00bd  | 0x0726774c  | kernel32.dll_LoadLibraryA
    0x012f  | 0xc99cc96a  | dnsapi.dll_DnsQuery_A
    0x0198  | 0x56a2b5f0  | kernel32.dll_ExitProcess
    0x01a4  | 0xe035f044  | kernel32.dll_Sleep
    0x01e4  | 0xcc8e00f4  | kernel32.dll_lstrlenA
    */
    uint32(@h01+0x00a3) == 0xe553a458 and
    uint32(@h01+0x00bd) == 0x0726774c and
    uint32(@h01+0x012f) == 0xc99cc96a and
    uint32(@h01+0x0198) == 0x56a2b5f0 and
    uint32(@h01+0x01a4) == 0xe035f044 and
    uint32(@h01+0x01e4) == 0xcc8e00f4
}
YARA Detection Rule: Cobaltbaltstrike_RAW_Payload_smb_stager_x86
Repository: Neo23x0/signature-base
Detects: Detects CobaltStrike payloads
Author: Avast Threat Intel Team
Reference: https://github.com/avast/ioc

Pattern signatures:
// x86 default eop
    $h01 = { FC E8 89 00 00 00 60 89 E5 31 D2 64 8B 52 30 8B 52 0C 8B 52 14 8B 72 28 }

Detection condition:
/*
    Payload API list:
    Offset  | Hash value  | API name
    0x00a1  | 0xe553a458  | kernel32.dll_VirtualAlloc
    0x00c4  | 0xd4df7045  | kernel32.dll_CreateNamedPipeA
    0x00d2  | 0xe27d6f28  | kernel32.dll_ConnectNamedPipe
    0x00f8  | 0xbb5f9ead  | kernel32.dll_ReadFile
    0x010d  | 0xbb

Full rule:
rule Cobaltbaltstrike_RAW_Payload_smb_stager_x86
{
  meta:
    author = "Avast Threat Intel Team"
    description = "Detects CobaltStrike payloads"
    reference = "https://github.com/avast/ioc"
    id = "29911a14-08ea-54de-9c07-630c6516bd49"
  strings:
    // x86 default eop
    $h01 = { FC E8 89 00 00 00 60 89 E5 31 D2 64 8B 52 30 8B 52 0C 8B 52 14 8B 72 28 }
  condition:
    /*
    Payload API list:
    Offset  | Hash value  | API name
    0x00a1  | 0xe553a458  | kernel32.dll_VirtualAlloc
    0x00c4  | 0xd4df7045  | kernel32.dll_CreateNamedPipeA
    0x00d2  | 0xe27d6f28  | kernel32.dll_ConnectNamedPipe
    0x00f8  | 0xbb5f9ead  | kernel32.dll_ReadFile
    0x010d  | 0xbb5f9ead  | kernel32.dll_ReadFile
    0x0131  | 0xfcddfac0  | kernel32.dll_DisconnectNamedPipe
    0x0139  | 0x528796c6  | kernel32.dll_CloseHandle
    0x014b  | 0x56a2b5f0  | kernel32.dll_ExitProcess
    */
    uint32(@h01+0x00a1) == 0xe553a458 and
    uint32(@h01+0x00c4) == 0xd4df7045 and
    uint32(@h01+0x00d2) == 0xe27d6f28 and
    uint32(@h01+0x00f8) == 0xbb5f9ead and
    uint32(@h01+0x010d) == 0xbb5f9ead and
    uint32(@h01+0x0131) == 0xfcddfac0 and
    uint32(@h01+0x0139) == 0x528796c6 and
    uint32(@h01+0x014b) == 0x56a2b5f0
}
YARA Detection Rule: Cobaltbaltstrike_RAW_Payload_TCP_Bind_x86
Repository: Neo23x0/signature-base
Detects: Detects CobaltStrike payloads
Author: Avast Threat Intel Team
Reference: https://github.com/avast/ioc

Pattern signatures:
// x86 default eop
    $h01 = { FC E8 89 00 00 00 60 89 E5 31 D2 64 8B 52 30 8B 52 0C 8B 52 14 8B 72 28 }

Detection condition:
/*
    Payload API list:
    Offset  | Hash value  | API name
    0x009c  | 0x0726774c  | kernel32.dll_LoadLibraryA
    0x00ac  | 0x006b8029  | ws2_32.dll_WSAStartup
    0x00bb  | 0xe0df0fea  | ws2_32.dll_WSASocketA
    0x00d5  | 0x6737dbc2  | ws2_32.dll_bind
    0x00de  | 0xff38e9b7  | ws2_32.dll_l

Full rule:
rule Cobaltbaltstrike_RAW_Payload_TCP_Bind_x86
{
  meta:
    author = "Avast Threat Intel Team"
    description = "Detects CobaltStrike payloads"
    reference = "https://github.com/avast/ioc"
    id = "ec0a9e27-3650-5393-a93b-2a461b9a0e29"
  strings:
    // x86 default eop
    $h01 = { FC E8 89 00 00 00 60 89 E5 31 D2 64 8B 52 30 8B 52 0C 8B 52 14 8B 72 28 }
  condition:
    /*
    Payload API list:
    Offset  | Hash value  | API name
    0x009c  | 0x0726774c  | kernel32.dll_LoadLibraryA
    0x00ac  | 0x006b8029  | ws2_32.dll_WSAStartup
    0x00bb  | 0xe0df0fea  | ws2_32.dll_WSASocketA
    0x00d5  | 0x6737dbc2  | ws2_32.dll_bind
    0x00de  | 0xff38e9b7  | ws2_32.dll_listen
    0x00e8  | 0xe13bec74  | ws2_32.dll_accept
    0x00f1  | 0x614d6e75  | ws2_32.dll_closesocket
    0x00fa  | 0x56a2b5f0  | kernel32.dll_ExitProcess
    0x0107  | 0x5fc8d902  | ws2_32.dll_recv
    0x011a  | 0xe553a458  | kernel32.dll_VirtualAlloc
    0x0128  | 0x5fc8d902  | ws2_32.dll_recv
    0x013d  | 0x614d6e75  | ws2_32.dll_closesocket
    */
    uint32(@h01+0x009c) == 0x0726774c and
    uint32(@h01+0x00ac) == 0x006b8029 and
    uint32(@h01+0x00bb) == 0xe0df0fea and
    uint32(@h01+0x00d5) == 0x6737dbc2 and
    uint32(@h01+0x00de) == 0xff38e9b7 and
    uint32(@h01+0x00e8) == 0xe13bec74 and
    uint32(@h01+0x00f1) == 0x614d6e75 and
    uint32(@h01+0x00fa) == 0x56a2b5f0 and
    uint32(@h01+0x0107) == 0x5fc8d902 and
    uint32(@h01+0x011a) == 0xe553a458 and
    uint32(@h01+0x0128) == 0x5fc8d902 and
    uint32(@h01+0x013d) == 0x614d6e75
}
YARA Detection Rule: Cobaltbaltstrike_RAW_Payload_TCP_Bind_x64
Repository: Neo23x0/signature-base
Detects: Detects CobaltStrike payloads
Author: Avast Threat Intel Team
Reference: https://github.com/avast/ioc

Pattern signatures:
// x64 default eop
    $h01 = { FC 48 83 E4 F0 E8 C8 00 00 00 41 51 41 50 52 51 56 48 31 D2 65 48 8B 52 }

Detection condition:
/*
    Payload API list:
    Offset  | Hash value  | API name
    0x0100  | 0x0726774c  | kernel32.dll_LoadLibraryA
    0x0111  | 0x006b8029  | ws2_32.dll_WSAStartup
    0x012d  | 0xe0df0fea  | ws2_32.dll_WSASocketA
    0x0142  | 0x6737dbc2  | ws2_32.dll_bind
    0x0150  | 0xff38e9b7  | ws2_32.dll_l

Full rule:
rule Cobaltbaltstrike_RAW_Payload_TCP_Bind_x64
{
  meta:
    author = "Avast Threat Intel Team"
    description = "Detects CobaltStrike payloads"
    reference = "https://github.com/avast/ioc"
    id = "3575408a-3309-5723-a49a-9c2088d43de9"
  strings:
    // x64 default eop
    $h01 = { FC 48 83 E4 F0 E8 C8 00 00 00 41 51 41 50 52 51 56 48 31 D2 65 48 8B 52 }
  condition:
    /*
    Payload API list:
    Offset  | Hash value  | API name
    0x0100  | 0x0726774c  | kernel32.dll_LoadLibraryA
    0x0111  | 0x006b8029  | ws2_32.dll_WSAStartup
    0x012d  | 0xe0df0fea  | ws2_32.dll_WSASocketA
    0x0142  | 0x6737dbc2  | ws2_32.dll_bind
    0x0150  | 0xff38e9b7  | ws2_32.dll_listen
    0x0161  | 0xe13bec74  | ws2_32.dll_accept
    0x016f  | 0x614d6e75  | ws2_32.dll_closesocket
    0x0198  | 0x5fc8d902  | ws2_32.dll_recv
    0x01b8  | 0xe553a458  | kernel32.dll_VirtualAlloc
    0x01d2  | 0x5fc8d902  | ws2_32.dll_recv
    0x01ee  | 0x614d6e75  | ws2_32.dll_closesocket
    */
    uint32(@h01+0x0100) == 0x0726774c and
    uint32(@h01+0x0111) == 0x006b8029 and
    uint32(@h01+0x012d) == 0xe0df0fea and
    uint32(@h01+0x0142) == 0x6737dbc2 and
    uint32(@h01+0x0150) == 0xff38e9b7 and
    uint32(@h01+0x0161) == 0xe13bec74 and
    uint32(@h01+0x016f) == 0x614d6e75 and
    uint32(@h01+0x0198) == 0x5fc8d902 and
    uint32(@h01+0x01b8) == 0xe553a458 and
    uint32(@h01+0x01d2) == 0x5fc8d902 and
    uint32(@h01+0x01ee) == 0x614d6e75
}
YARA Detection Rule: Cobaltbaltstrike_RAW_Payload_TCP_Reverse_x86
Repository: Neo23x0/signature-base
Detects: Detects CobaltStrike payloads
Author: Avast Threat Intel Team
Reference: https://github.com/avast/ioc

Pattern signatures:
// x86 default eop
    $h01 = { FC E8 89 00 00 00 60 89 E5 31 D2 64 8B 52 30 8B 52 0C 8B 52 14 8B 72 28 }

Detection condition:
/*
    Payload API list:
    Offset  | Hash value  | API name
    0x009c  | 0x0726774c  | kernel32.dll_LoadLibraryA
    0x00ac  | 0x006b8029  | ws2_32.dll_WSAStartup
    0x00bb  | 0xe0df0fea  | ws2_32.dll_WSASocketA
    0x00d5  | 0x6174a599  | ws2_32.dll_connect
    0x00e5  | 0x56a2b5f0  | kernel32.

Full rule:
rule Cobaltbaltstrike_RAW_Payload_TCP_Reverse_x86
{
  meta:
    author = "Avast Threat Intel Team"
    description = "Detects CobaltStrike payloads"
    reference = "https://github.com/avast/ioc"
    id = "ac824189-614d-5bff-9bbb-a4244cace563"
  strings:
    // x86 default eop
    $h01 = { FC E8 89 00 00 00 60 89 E5 31 D2 64 8B 52 30 8B 52 0C 8B 52 14 8B 72 28 }
  condition:
    /*
    Payload API list:
    Offset  | Hash value  | API name
    0x009c  | 0x0726774c  | kernel32.dll_LoadLibraryA
    0x00ac  | 0x006b8029  | ws2_32.dll_WSAStartup
    0x00bb  | 0xe0df0fea  | ws2_32.dll_WSASocketA
    0x00d5  | 0x6174a599  | ws2_32.dll_connect
    0x00e5  | 0x56a2b5f0  | kernel32.dll_ExitProcess
    0x00f2  | 0x5fc8d902  | ws2_32.dll_recv
    0x0105  | 0xe553a458  | kernel32.dll_VirtualAlloc
    0x0113  | 0x5fc8d902  | ws2_32.dll_recv
    */
    uint32(@h01+0x009c) == 0x0726774c and
    uint32(@h01+0x00ac) == 0x006b8029 and
    uint32(@h01+0x00bb) == 0xe0df0fea and
    uint32(@h01+0x00d5) == 0x6174a599 and
    uint32(@h01+0x00e5) == 0x56a2b5f0 and
    uint32(@h01+0x00f2) == 0x5fc8d902 and
    uint32(@h01+0x0105) == 0xe553a458 and
    uint32(@h01+0x0113) == 0x5fc8d902
}
YARA Detection Rule: Cobaltbaltstrike_RAW_Payload_TCP_Reverse_x64
Repository: Neo23x0/signature-base
Detects: Detects CobaltStrike payloads
Author: Avast Threat Intel Team
Reference: https://github.com/avast/ioc

Pattern signatures:
// x64 default eop
    $h01 = { FC 48 83 E4 F0 E8 C8 00 00 00 41 51 41 50 52 51 56 48 31 D2 65 48 8B 52 }

Detection condition:
/*
    Payload API list:
    Offset  | Hash value  | API name
    0x0100  | 0x0726774c  | kernel32.dll_LoadLibraryA
    0x0111  | 0x006b8029  | ws2_32.dll_WSAStartup
    0x012d  | 0xe0df0fea  | ws2_32.dll_WSASocketA
    0x0142  | 0x6174a599  | ws2_32.dll_connect
    0x016b  | 0x5fc8d902  | ws2_32.dl

Full rule:
rule Cobaltbaltstrike_RAW_Payload_TCP_Reverse_x64
{
  meta:
    author = "Avast Threat Intel Team"
    description = "Detects CobaltStrike payloads"
    reference = "https://github.com/avast/ioc"
    id = "21151a9c-1d15-514f-b33b-c9eff08463fb"
  strings:
    // x64 default eop
    $h01 = { FC 48 83 E4 F0 E8 C8 00 00 00 41 51 41 50 52 51 56 48 31 D2 65 48 8B 52 }
  condition:
    /*
    Payload API list:
    Offset  | Hash value  | API name
    0x0100  | 0x0726774c  | kernel32.dll_LoadLibraryA
    0x0111  | 0x006b8029  | ws2_32.dll_WSAStartup
    0x012d  | 0xe0df0fea  | ws2_32.dll_WSASocketA
    0x0142  | 0x6174a599  | ws2_32.dll_connect
    0x016b  | 0x5fc8d902  | ws2_32.dll_recv
    0x018b  | 0xe553a458  | kernel32.dll_VirtualAlloc
    0x01a5  | 0x5fc8d902  | ws2_32.dll_recv
    0x01c1  | 0x614d6e75  | ws2_32.dll_closesocket
    */
    uint32(@h01+0x0100) == 0x0726774c and
    uint32(@h01+0x0111) == 0x006b8029 and
    uint32(@h01+0x012d) == 0xe0df0fea and
    uint32(@h01+0x0142) == 0x6174a599 and
    uint32(@h01+0x016b) == 0x5fc8d902 and
    uint32(@h01+0x018b) == 0xe553a458 and
    uint32(@h01+0x01a5) == 0x5fc8d902 and
    uint32(@h01+0x01c1) == 0x614d6e75
}