YARA Detection Rule: CobaltStrike_Resources_Covertvpn_Dll_v2_1_to_v4_x
Repository: Neo23x0/signature-base
Detects: Cobalt Strike's resources/covertvpn.dll signature for version v2.2 to v4.4
Author: gssincla@google.com
Reference: https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse

Pattern signatures:
/*
		5?                  push    esi
		68 [4]              push    offset ProcName; "IsWow64Process"
		68 [4]              push    offset ModuleName; "kernel32"
		C7 [3-5] 00 00 00 00  mov     [ebp+var_9C], 0                 // the displacement bytes are only 3 in v2.x, 5 in v3.x->v4.x
		FF 15 [4]           call    ds:GetModuleHandleA
		50                  push    eax; hModule
		FF 15 [4]           call    ds:GetProcAddress
		8B ??               mov     esi, eax
		85 ??               test    esi, esi
		74 ??               jz      short loc_1000298B
		8D [3-5]            lea     eax, [ebp+var_9C]                 // the displacement bytes are only 3 in v2.x, 5 in v3.x->v4.x
		5?                  push    eax
		FF 15 [4]           call    ds:GetCurrentProcess
		50                  push    eax
	*/

	$dropComponentsAndActivateDriver_prologue = {
			5? 
			68 [4]
			68 [4]
			C7 [3-5] 00 00 00 00 
			FF 15 [4]
			50
			FF 15 [4]
			8B ?? 
			85 ?? 
			74 ??
			8D [3-5]
			5? 
			FF 15 [4]
			

Detection condition:
all of them

Full rule:
rule CobaltStrike_Resources_Covertvpn_Dll_v2_1_to_v4_x
{
	meta:
		description = "Cobalt Strike's resources/covertvpn.dll signature for version v2.2 to v4.4"
		hash =  "0a452a94d53e54b1df6ba02bc2f02e06d57153aad111171a94ec65c910d22dcf"
		author = "gssincla@google.com"
		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
		date = "2022-11-18"
		
		id = "a65b855c-5703-5b9f-bb57-da8ebf898f9b"
	strings:
	/*
		5?                  push    esi
		68 [4]              push    offset ProcName; "IsWow64Process"
		68 [4]              push    offset ModuleName; "kernel32"
		C7 [3-5] 00 00 00 00  mov     [ebp+var_9C], 0                 // the displacement bytes are only 3 in v2.x, 5 in v3.x->v4.x
		FF 15 [4]           call    ds:GetModuleHandleA
		50                  push    eax; hModule
		FF 15 [4]           call    ds:GetProcAddress
		8B ??               mov     esi, eax
		85 ??               test    esi, esi
		74 ??               jz      short loc_1000298B
		8D [3-5]            lea     eax, [ebp+var_9C]                 // the displacement bytes are only 3 in v2.x, 5 in v3.x->v4.x
		5?                  push    eax
		FF 15 [4]           call    ds:GetCurrentProcess
		50                  push    eax
	*/

	$dropComponentsAndActivateDriver_prologue = {
			5? 
			68 [4]
			68 [4]
			C7 [3-5] 00 00 00 00 
			FF 15 [4]
			50
			FF 15 [4]
			8B ?? 
			85 ?? 
			74 ??
			8D [3-5]
			5? 
			FF 15 [4]
			50
		}

	/*
		6A 00          push    0; AccessMode
		5?             push    esi; FileName
		E8 [4]         call    __access
		83 C4 08       add     esp, 8
		83 F8 FF       cmp     eax, 0FFFFFFFFh
		74 ??          jz      short loc_100028A7
		5?             push    esi
		68 [4]         push    offset aWarningSExists; "Warning: %s exists\n"   // this may not exist in v2.x samples
		E8 [4]         call    nullsub_1
		83 C4 08       add     esp, 8             // if the push doesnt exist, then this is 04, not 08
		// v2.x