YARA Detection Rule: CobaltStrike_Resources_Bypassuactoken_Dll_v3_11_to_v3_14
Repository: Neo23x0/signature-base
Detects: Cobalt Strike's resources/bypassuactoken.dll from v3.11 to v3.14 (32-bit version)
Author: gssincla@google.com
Reference: https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse

Pattern signatures:
/*
		5?                 push    eax; ReturnLength
		5?                 push    edi; TokenInformationLength
		5?                 push    edi; TokenInformation
		8B ??              mov     ebx, ecx
		6A 19              push    19h; TokenInformationClass
		5?                 push    ebx; TokenHandle
		FF 15 [4]          call    ds:GetTokenInformation
		85 C0              test    eax, eax
		75 ??              jnz     short loc_10001100
		FF 15 [4]          call    ds:GetLastError
		83 ?? 7A           cmp     eax, 7Ah ; 'z'
		75 ??              jnz     short loc_10001100
		FF [2]             push    [ebp+ReturnLength]; uBytes
		5?                 push    edi; uFlags
		FF 15 [4]          call    ds:LocalAlloc
		8B ??              mov     esi, eax
		8D [2]             lea     eax, [ebp+ReturnLength]
		5?                 push    eax; ReturnLength
		FF [2]             push    [ebp+ReturnLength]; TokenInformationLength
		5?                 push    esi; TokenInformation
		6A 19              push 

Detection condition:
all of them

Full rule:
rule CobaltStrike_Resources_Bypassuactoken_Dll_v3_11_to_v3_14
{
	meta:
		description = "Cobalt Strike's resources/bypassuactoken.dll from v3.11 to v3.14 (32-bit version)"
		hash =  "df1c7256dfd78506e38c64c54c0645b6a56fc56b2ffad8c553b0f770c5683070"
		author = "gssincla@google.com"
		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
		date = "2022-11-18"
		
		id = "b9f25fa5-bd1d-5ba0-9b1d-bb97e1dbf76b"
	strings:
	/*
		5?                 push    eax; ReturnLength
		5?                 push    edi; TokenInformationLength
		5?                 push    edi; TokenInformation
		8B ??              mov     ebx, ecx
		6A 19              push    19h; TokenInformationClass
		5?                 push    ebx; TokenHandle
		FF 15 [4]          call    ds:GetTokenInformation
		85 C0              test    eax, eax
		75 ??              jnz     short loc_10001100
		FF 15 [4]          call    ds:GetLastError
		83 ?? 7A           cmp     eax, 7Ah ; 'z'
		75 ??              jnz     short loc_10001100
		FF [2]             push    [ebp+ReturnLength]; uBytes
		5?                 push    edi; uFlags
		FF 15 [4]          call    ds:LocalAlloc
		8B ??              mov     esi, eax
		8D [2]             lea     eax, [ebp+ReturnLength]
		5?                 push    eax; ReturnLength
		FF [2]             push    [ebp+ReturnLength]; TokenInformationLength
		5?                 push    esi; TokenInformation
		6A 19              push    19h; TokenInformationClass
		5?                 push    ebx; TokenHandle
		FF 15 [4]          call    ds:GetTokenInformation
		85 C0              test    eax, eax
		74 ??              jz      short loc_10001103
		FF ??              push    dword ptr [esi]; pSid
		FF 15 [4]          call    ds:GetSidSubAuthorityCount
		8A ??              mov     al, [eax]
		FE C8              dec     al
		0F B6 C0           movzx   eax, al
		5?                 push    eax; nSubAuthority
		FF ??              push    dwo