YARA Detection Rule: CobaltStrike_Resources_Bypassuactoken_x64_Dll_v3_11_to_v3_14
Repository: Neo23x0/signature-base
Detects: Cobalt Strike's resources/bypassuactoken.x64.dll from v3.11 to v3.14 (64-bit version)
Author: gssincla@google.com
Reference: https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse

Pattern signatures:
/*
		83 F8 7A          cmp     eax, 7Ah ; 'z'
		75 59             jnz     short loc_1800014BC
		8B 54 24 48       mov     edx, dword ptr [rsp+38h+uBytes]; uBytes
		33 C9             xor     ecx, ecx; uFlags
		FF 15 49 9C 00 00 call    cs:LocalAlloc
		44 8B 4C 24 48    mov     r9d, dword ptr [rsp+38h+uBytes]; TokenInformationLength
		8D 53 19          lea     edx, [rbx+19h]; TokenInformationClass
		48 8B F8          mov     rdi, rax
		48 8D 44 24 48    lea     rax, [rsp+38h+uBytes]
		48 8B CE          mov     rcx, rsi; TokenHandle
		4C 8B C7          mov     r8, rdi; TokenInformation
		48 89 44 24 20    mov     [rsp+38h+ReturnLength], rax; ReturnLength
		FF 15 B0 9B 00 00 call    cs:GetTokenInformation
		85 C0             test    eax, eax
		74 2D             jz      short loc_1800014C1
		48 8B 0F          mov     rcx, [rdi]; pSid
		FF 15 AB 9B 00 00 call    cs:GetSidSubAuthorityCount
		8D 73 01          lea     esi, [rbx+1]
		8A 08             mov     cl, [rax]
		40 2A CE          sub  

Detection condition:
all of them

Full rule:
rule CobaltStrike_Resources_Bypassuactoken_x64_Dll_v3_11_to_v3_14
{
	meta:
		description = "Cobalt Strike's resources/bypassuactoken.x64.dll from v3.11 to v3.14 (64-bit version)"
		hash =  "853068822bbc6b1305b2a9780cf1034f5d9d[PII_REDACTED]a6917f9dbb42f30d67"
		author = "gssincla@google.com"
		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
		date = "2022-11-18"
		
		id = "c89befcd-a622-5947-9ce3-a6031901a45a"
	strings:
	/*
		83 F8 7A          cmp     eax, 7Ah ; 'z'
		75 59             jnz     short loc_1800014BC
		8B 54 24 48       mov     edx, dword ptr [rsp+38h+uBytes]; uBytes
		33 C9             xor     ecx, ecx; uFlags
		FF 15 49 9C 00 00 call    cs:LocalAlloc
		44 8B 4C 24 48    mov     r9d, dword ptr [rsp+38h+uBytes]; TokenInformationLength
		8D 53 19          lea     edx, [rbx+19h]; TokenInformationClass
		48 8B F8          mov     rdi, rax
		48 8D 44 24 48    lea     rax, [rsp+38h+uBytes]
		48 8B CE          mov     rcx, rsi; TokenHandle
		4C 8B C7          mov     r8, rdi; TokenInformation
		48 89 44 24 20    mov     [rsp+38h+ReturnLength], rax; ReturnLength
		FF 15 B0 9B 00 00 call    cs:GetTokenInformation
		85 C0             test    eax, eax
		74 2D             jz      short loc_1800014C1
		48 8B 0F          mov     rcx, [rdi]; pSid
		FF 15 AB 9B 00 00 call    cs:GetSidSubAuthorityCount
		8D 73 01          lea     esi, [rbx+1]
		8A 08             mov     cl, [rax]
		40 2A CE          sub     cl, sil
		0F B6 D1          movzx   edx, cl; nSubAuthority
		48 8B 0F          mov     rcx, [rdi]; pSid
		FF 15 9F 9B 00 00 call    cs:GetSidSubAuthority
		81 38 00 30 00 00 cmp     dword ptr [rax], 3000h
	*/

	$isHighIntegrityProcess = {
			83 ?? 7A
			75 ??
			8B [3]
			33 ??
			FF 15 [4]
			44 [4]
			8D [2]
			48 8B ??
			48 8D [3]
			48 8B ??
			4C 8B ??
			48 89 [3]
			FF 15 [4]
			85 C0
			74 ??
			48 8B ??
			FF 15 [4]
			8D [2]
			8A ??
			40 [2]
			0F B6 D1
			48 8B 0F
			FF 15 [4]