deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: Cobaltbaltstrike_RAW_Payload_http_stager_x86
Repository: Neo23x0/signature-base
Detects: Detects CobaltStrike payloads
Author: Avast Threat Intel Team
Reference: https://github.com/avast/ioc

Pattern signatures:
// x86 default eop
    $h01 = { FC E8 89 00 00 00 60 89 E5 31 D2 64 8B 52 30 8B 52 0C 8B 52 14 8B 72 28 }

Detection condition:
/*
    Payload API list:
    Offset  | Hash value  | API name
    0x009c  | 0x0726774c  | kernel32.dll_LoadLibraryA
    0x00aa  | 0xa779563a  | wininet.dll_InternetOpenA
    0x00c6  | 0xc69f8957  | wininet.dll_InternetConnectA
    0x00de  | 0x3b2e55eb  | wininet.dll_HttpOpenRequestA
    0x00f2  | 0x

Full rule:
rule Cobaltbaltstrike_RAW_Payload_http_stager_x86
{
  meta:
    author = "Avast Threat Intel Team"
    description = "Detects CobaltStrike payloads"
    reference = "https://github.com/avast/ioc"
    id = "01f89b14-55f2-5a5e-b0d5-6bca609621fe"
  strings:
    // x86 default eop
    $h01 = { FC E8 89 00 00 00 60 89 E5 31 D2 64 8B 52 30 8B 52 0C 8B 52 14 8B 72 28 }
  condition:
    /*
    Payload API list:
    Offset  | Hash value  | API name
    0x009c  | 0x0726774c  | kernel32.dll_LoadLibraryA
    0x00aa  | 0xa779563a  | wininet.dll_InternetOpenA
    0x00c6  | 0xc69f8957  | wininet.dll_InternetConnectA
    0x00de  | 0x3b2e55eb  | wininet.dll_HttpOpenRequestA
    0x00f2  | 0x7b18062d  | wininet.dll_HttpSendRequestA
    0x010b  | 0x5de2c5aa  | kernel32.dll_GetLastError
    0x0114  | 0x315e2145  | user32.dll_GetDesktopWindow
    0x0123  | 0x0be057b7  | wininet.dll_InternetErrorDlg
    0x02c4  | 0x56a2b5f0  | kernel32.dll_ExitProcess
    0x02d8  | 0xe553a458  | kernel32.dll_VirtualAlloc
    0x02f3  | 0xe2899612  | wininet.dll_InternetReadFile
    */
    uint32(@h01+0x009c) == 0x0726774c and
    uint32(@h01+0x00aa) == 0xa779563a and
    uint32(@h01+0x00c6) == 0xc69f8957 and
    uint32(@h01+0x00de) == 0x3b2e55eb and
    uint32(@h01+0x00f2) == 0x7b18062d and
    uint32(@h01+0x010b) == 0x5de2c5aa and
    uint32(@h01+0x0114) == 0x315e2145 and
    uint32(@h01+0x0123) == 0x0be057b7 and
    uint32(@h01+0x02c4) == 0x56a2b5f0 and
    uint32(@h01+0x02d8) == 0xe553a458 and
    uint32(@h01+0x02f3) == 0xe2899612
}
YARA Detection Rule: Cobaltbaltstrike_RAW_Payload_http_stager_x64
Repository: Neo23x0/signature-base
Detects: Detects CobaltStrike payloads
Author: Avast Threat Intel Team
Reference: https://github.com/avast/ioc

Pattern signatures:
// x64 default eop
    $h01 = { FC 48 83 E4 F0 E8 C8 00 00 00 41 51 41 50 52 51 56 48 31 D2 65 48 8B 52 }

Detection condition:
/*
    Payload API list:
    Offset  | Hash value  | API name
    0x00e9  | 0x0726774c  | kernel32.dll_LoadLibraryA
    0x0101  | 0xa779563a  | wininet.dll_InternetOpenA
    0x0120  | 0xc69f8957  | wininet.dll_InternetConnectA
    0x013f  | 0x3b2e55eb  | wininet.dll_HttpOpenRequestA
    0x0163  | 0x

Full rule:
rule Cobaltbaltstrike_RAW_Payload_http_stager_x64
{
  meta:
    author = "Avast Threat Intel Team"
    description = "Detects CobaltStrike payloads"
    reference = "https://github.com/avast/ioc"
    id = "7eeeb2a1-4903-5649-ae30-fd43367ab468"
  strings:
    // x64 default eop
    $h01 = { FC 48 83 E4 F0 E8 C8 00 00 00 41 51 41 50 52 51 56 48 31 D2 65 48 8B 52 }
  condition:
    /*
    Payload API list:
    Offset  | Hash value  | API name
    0x00e9  | 0x0726774c  | kernel32.dll_LoadLibraryA
    0x0101  | 0xa779563a  | wininet.dll_InternetOpenA
    0x0120  | 0xc69f8957  | wininet.dll_InternetConnectA
    0x013f  | 0x3b2e55eb  | wininet.dll_HttpOpenRequestA
    0x0163  | 0x7b18062d  | wininet.dll_HttpSendRequestA
    0x0308  | 0x56a2b5f0  | kernel32.dll_ExitProcess
    0x0324  | 0xe553a458  | kernel32.dll_VirtualAlloc
    0x0342  | 0xe2899612  | wininet.dll_InternetReadFile
    */
    uint32(@h01+0x00e9) == 0x0726774c and
    uint32(@h01+0x0101) == 0xa779563a and
    uint32(@h01+0x0120) == 0xc69f8957 and
    uint32(@h01+0x013f) == 0x3b2e55eb and
    uint32(@h01+0x0163) == 0x7b18062d and
    uint32(@h01+0x0308) == 0x56a2b5f0 and
    uint32(@h01+0x0324) == 0xe553a458 and
    uint32(@h01+0x0342) == 0xe2899612
}
YARA Detection Rule: Cobaltbaltstrike_RAW_Payload_https_stager_x86
Repository: Neo23x0/signature-base
Detects: Detects CobaltStrike payloads
Author: Avast Threat Intel Team
Reference: https://github.com/avast/ioc

Pattern signatures:
// x86 default eop
    $h01 = { FC E8 89 00 00 00 60 89 E5 31 D2 64 8B 52 30 8B 52 0C 8B 52 14 8B 72 28 }

Detection condition:
/*
    Payload API list:
    Offset  | Hash value  | API name
    0x009c  | 0x0726774c  | kernel32.dll_LoadLibraryA
    0x00af  | 0xa779563a  | wininet.dll_InternetOpenA
    0x00cb  | 0xc69f8957  | wininet.dll_InternetConnectA
    0x00e7  | 0x3b2e55eb  | wininet.dll_HttpOpenRequestA
    0x0100  | 0x

Full rule:
rule Cobaltbaltstrike_RAW_Payload_https_stager_x86
{
  meta:
    author = "Avast Threat Intel Team"
    description = "Detects CobaltStrike payloads"
    reference = "https://github.com/avast/ioc"
    id = "f1d7e939-92b5-5441-8014-b2390854d059"
  strings:
    // x86 default eop
    $h01 = { FC E8 89 00 00 00 60 89 E5 31 D2 64 8B 52 30 8B 52 0C 8B 52 14 8B 72 28 }
  condition:
    /*
    Payload API list:
    Offset  | Hash value  | API name
    0x009c  | 0x0726774c  | kernel32.dll_LoadLibraryA
    0x00af  | 0xa779563a  | wininet.dll_InternetOpenA
    0x00cb  | 0xc69f8957  | wininet.dll_InternetConnectA
    0x00e7  | 0x3b2e55eb  | wininet.dll_HttpOpenRequestA
    0x0100  | 0x869e4675  | wininet.dll_InternetSetOptionA
    0x0110  | 0x7b18062d  | wininet.dll_HttpSendRequestA
    0x0129  | 0x5de2c5aa  | kernel32.dll_GetLastError
    0x0132  | 0x315e2145  | user32.dll_GetDesktopWindow
    0x0141  | 0x0be057b7  | wininet.dll_InternetErrorDlg
    0x02e9  | 0x56a2b5f0  | kernel32.dll_ExitProcess
    0x02fd  | 0xe553a458  | kernel32.dll_VirtualAlloc
    0x0318  | 0xe2899612  | wininet.dll_InternetReadFile
    */
    uint32(@h01+0x009c) == 0x0726774c and
    uint32(@h01+0x00af) == 0xa779563a and
    uint32(@h01+0x00cb) == 0xc69f8957 and
    uint32(@h01+0x00e7) == 0x3b2e55eb and
    uint32(@h01+0x0100) == 0x869e4675 and
    uint32(@h01+0x0110) == 0x7b18062d and
    uint32(@h01+0x0129) == 0x5de2c5aa and
    uint32(@h01+0x0132) == 0x315e2145 and
    uint32(@h01+0x0141) == 0x0be057b7 and
    uint32(@h01+0x02e9) == 0x56a2b5f0 and
    uint32(@h01+0x02fd) == 0xe553a458 and
    uint32(@h01+0x0318) == 0xe2899612
}
YARA Detection Rule: Cobaltbaltstrike_RAW_Payload_https_stager_x64
Repository: Neo23x0/signature-base
Detects: Detects CobaltStrike payloads
Author: Avast Threat Intel Team
Reference: https://github.com/avast/ioc

Pattern signatures:
// x64 default eop
    $h01 = { FC 48 83 E4 F0 E8 C8 00 00 00 41 51 41 50 52 51 56 48 31 D2 65 48 8B 52 }

Detection condition:
/*
    Payload API list:
    Offset  | Hash value  | API name
    0x00e9  | 0x0726774c  | kernel32.dll_LoadLibraryA
    0x0101  | 0xa779563a  | wininet.dll_InternetOpenA
    0x0123  | 0xc69f8957  | wininet.dll_InternetConnectA
    0x0142  | 0x3b2e55eb  | wininet.dll_HttpOpenRequestA
    0x016c  | 0x

Full rule:
rule Cobaltbaltstrike_RAW_Payload_https_stager_x64
{
  meta:
    author = "Avast Threat Intel Team"
    description = "Detects CobaltStrike payloads"
    reference = "https://github.com/avast/ioc"
    id = "5f9c7426-63be-5049-91fc-63b5c29618bd"
  strings:
    // x64 default eop
    $h01 = { FC 48 83 E4 F0 E8 C8 00 00 00 41 51 41 50 52 51 56 48 31 D2 65 48 8B 52 }
  condition:
    /*
    Payload API list:
    Offset  | Hash value  | API name
    0x00e9  | 0x0726774c  | kernel32.dll_LoadLibraryA
    0x0101  | 0xa779563a  | wininet.dll_InternetOpenA
    0x0123  | 0xc69f8957  | wininet.dll_InternetConnectA
    0x0142  | 0x3b2e55eb  | wininet.dll_HttpOpenRequestA
    0x016c  | 0x869e4675  | wininet.dll_InternetSetOptionA
    0x0186  | 0x7b18062d  | wininet.dll_HttpSendRequestA
    0x032b  | 0x56a2b5f0  | kernel32.dll_ExitProcess
    0x0347  | 0xe553a458  | kernel32.dll_VirtualAlloc
    0x0365  | 0xe2899612  | wininet.dll_InternetReadFile
    */
    uint32(@h01+0x00e9) == 0x0726774c and
    uint32(@h01+0x0101) == 0xa779563a and
    uint32(@h01+0x0123) == 0xc69f8957 and
    uint32(@h01+0x0142) == 0x3b2e55eb and
    uint32(@h01+0x016c) == 0x869e4675 and
    uint32(@h01+0x0186) == 0x7b18062d and
    uint32(@h01+0x032b) == 0x56a2b5f0 and
    uint32(@h01+0x0347) == 0xe553a458 and
    uint32(@h01+0x0365) == 0xe2899612
}
YARA Detection Rule: Cobaltbaltstrike_RAW_Payload_dns_stager_x86_UTF16
Repository: Neo23x0/signature-base
Detects: Detects CobaltStrike payloads
Author: Avast Threat Intel Team
Reference: https://github.com/avast/ioc

Pattern signatures:
// x86 default eop utf-16
    $h01 = { FC 00 E8 00 89 00 00 00 00 00 00 00 60 00 89 00 E5 00 31 00 D2 00 64 00 8B 00 52 00 30 00 8B 00 52 00 0C 00 8B 00 52 00 14 00 8B 00 72 00 28 }

Detection condition:
uint32(@h01+0x0149) == 0xe5005300 and
    uint32(@h01+0x017d) == 0x07002600 and
    uint32(@h01+0x0261) == 0xc9009c00 and
    uint32(@h01+0x0333) == 0x5600a200 and
    uint32(@h01+0x034b) == 0xe0003500 and
    uint32(@h01+0x03cb) == 0xcc008e00

Full rule:
rule Cobaltbaltstrike_RAW_Payload_dns_stager_x86_UTF16
{
  meta:
    author = "Avast Threat Intel Team"
    description = "Detects CobaltStrike payloads"
    reference = "https://github.com/avast/ioc"
    id = "d148ca33-b233-519d-8ba4-d389de721d15"
  strings:
    // x86 default eop utf-16
    $h01 = { FC 00 E8 00 89 00 00 00 00 00 00 00 60 00 89 00 E5 00 31 00 D2 00 64 00 8B 00 52 00 30 00 8B 00 52 00 0C 00 8B 00 52 00 14 00 8B 00 72 00 28 }
  condition:
    uint32(@h01+0x0149) == 0xe5005300 and
    uint32(@h01+0x017d) == 0x07002600 and
    uint32(@h01+0x0261) == 0xc9009c00 and
    uint32(@h01+0x0333) == 0x5600a200 and
    uint32(@h01+0x034b) == 0xe0003500 and
    uint32(@h01+0x03cb) == 0xcc008e00
}
YARA Detection Rule: Cobaltbaltstrike_RAW_Payload_smb_stager_x86_UTF16
Repository: Neo23x0/signature-base
Detects: Detects CobaltStrike payloads
Author: Avast Threat Intel Team
Reference: https://github.com/avast/ioc

Pattern signatures:
// x86 default eop utf-16
    $h01 = { FC 00 E8 00 89 00 00 00 00 00 00 00 60 00 89 00 E5 00 31 00 D2 00 64 00 8B 00 52 00 30 00 8B 00 52 00 0C 00 8B 00 52 00 14 00 8B 00 72 00 28 }

Detection condition:
uint32(@h01+0x0145) == 0xe5005300 and
    uint32(@h01+0x018b) == 0xd400df00 and
    uint32(@h01+0x01a7) == 0xe2007d00 and
    uint32(@h01+0x01f3) == 0xbb005f00 and
    uint32(@h01+0x021d) == 0xbb005f00 and
    uint32(@h01+0x0265) == 0xfc00dd00 and
    uint32(@h01+0x0275) == 0x52008700 and
    uint32

Full rule:
rule Cobaltbaltstrike_RAW_Payload_smb_stager_x86_UTF16
{
  meta:
    author = "Avast Threat Intel Team"
    description = "Detects CobaltStrike payloads"
    reference = "https://github.com/avast/ioc"
    id = "d88e050f-9e6c-5349-b809-ad7dc25a79b9"
  strings:
    // x86 default eop utf-16
    $h01 = { FC 00 E8 00 89 00 00 00 00 00 00 00 60 00 89 00 E5 00 31 00 D2 00 64 00 8B 00 52 00 30 00 8B 00 52 00 0C 00 8B 00 52 00 14 00 8B 00 72 00 28 }
  condition:
    uint32(@h01+0x0145) == 0xe5005300 and
    uint32(@h01+0x018b) == 0xd400df00 and
    uint32(@h01+0x01a7) == 0xe2007d00 and
    uint32(@h01+0x01f3) == 0xbb005f00 and
    uint32(@h01+0x021d) == 0xbb005f00 and
    uint32(@h01+0x0265) == 0xfc00dd00 and
    uint32(@h01+0x0275) == 0x52008700 and
    uint32(@h01+0x0299) == 0x5600a200
}
YARA Detection Rule: Cobaltbaltstrike_RAW_Payload_TCP_Bind_x86_UTF16
Repository: Neo23x0/signature-base
Detects: Detects CobaltStrike payloads
Author: Avast Threat Intel Team
Reference: https://github.com/avast/ioc

Pattern signatures:
// x86 default eop utf-16
    $h01 = { FC 00 E8 00 89 00 00 00 00 00 00 00 60 00 89 00 E5 00 31 00 D2 00 64 00 8B 00 52 00 30 00 8B 00 52 00 0C 00 8B 00 52 00 14 00 8B 00 72 00 28 }

Detection condition:
uint32(@h01+0x013b) == 0x07002600 and
    uint32(@h01+0x015b) == 0x00006b00 and
    uint32(@h01+0x0179) == 0xe000df00 and
    uint32(@h01+0x01ad) == 0x67003700 and
    uint32(@h01+0x01bf) == 0xff003800 and
    uint32(@h01+0x01d3) == 0xe1003b00 and
    uint32(@h01+0x01e5) == 0x61004d00 and
    uint32

Full rule:
rule Cobaltbaltstrike_RAW_Payload_TCP_Bind_x86_UTF16
{
  meta:
    author = "Avast Threat Intel Team"
    description = "Detects CobaltStrike payloads"
    reference = "https://github.com/avast/ioc"
    id = "7f17985d-b245-5e95-9b35-af669aafc263"
  strings:
    // x86 default eop utf-16
    $h01 = { FC 00 E8 00 89 00 00 00 00 00 00 00 60 00 89 00 E5 00 31 00 D2 00 64 00 8B 00 52 00 30 00 8B 00 52 00 0C 00 8B 00 52 00 14 00 8B 00 72 00 28 }
  condition:
    uint32(@h01+0x013b) == 0x07002600 and
    uint32(@h01+0x015b) == 0x00006b00 and
    uint32(@h01+0x0179) == 0xe000df00 and
    uint32(@h01+0x01ad) == 0x67003700 and
    uint32(@h01+0x01bf) == 0xff003800 and
    uint32(@h01+0x01d3) == 0xe1003b00 and
    uint32(@h01+0x01e5) == 0x61004d00 and
    uint32(@h01+0x01f7) == 0x5600a200 and
    uint32(@h01+0x0211) == 0x5f00c800 and
    uint32(@h01+0x0237) == 0xe5005300 and
    uint32(@h01+0x0253) == 0x5f00c800 and
    uint32(@h01+0x027d) == 0x61004d00
}
YARA Detection Rule: Cobaltbaltstrike_RAW_Payload_TCP_Bind_x64_UTF16
Repository: Neo23x0/signature-base
Detects: Detects CobaltStrike payloads
Author: Avast Threat Intel Team
Reference: https://github.com/avast/ioc

Pattern signatures:
// x64 default eop utf16
    $h01 = { FC 00 48 00 83 00 E4 00 F0 00 E8 00 C8 00 00 00 00 00 00 00 41 00 51 00 41 00 50 00 52 00 51 00 56 00 48 00 31 00 D2 00 65 00 48 00 8B 00 52 }

Detection condition:
uint32(@h01+0x0203) == 0x07002600 and
    uint32(@h01+0x0225) == 0x00006b00 and
    uint32(@h01+0x025d) == 0xe000df00 and
    uint32(@h01+0x0287) == 0x67003700 and
    uint32(@h01+0x02a3) == 0xff003800 and
    uint32(@h01+0x02c5) == 0xe1003b00 and
    uint32(@h01+0x02e1) == 0x61004d00 and
    uint32

Full rule:
rule Cobaltbaltstrike_RAW_Payload_TCP_Bind_x64_UTF16
{
  meta:
    author = "Avast Threat Intel Team"
    description = "Detects CobaltStrike payloads"
    reference = "https://github.com/avast/ioc"
    id = "bd52fb44-379a-5c82-9c7c-b10c8080b53f"
  strings:
    // x64 default eop utf16
    $h01 = { FC 00 48 00 83 00 E4 00 F0 00 E8 00 C8 00 00 00 00 00 00 00 41 00 51 00 41 00 50 00 52 00 51 00 56 00 48 00 31 00 D2 00 65 00 48 00 8B 00 52 }
  condition:
    uint32(@h01+0x0203) == 0x07002600 and
    uint32(@h01+0x0225) == 0x00006b00 and
    uint32(@h01+0x025d) == 0xe000df00 and
    uint32(@h01+0x0287) == 0x67003700 and
    uint32(@h01+0x02a3) == 0xff003800 and
    uint32(@h01+0x02c5) == 0xe1003b00 and
    uint32(@h01+0x02e1) == 0x61004d00 and
    uint32(@h01+0x0333) == 0x5f00c800 and
    uint32(@h01+0x0373) == 0xe5005300 and
    uint32(@h01+0x03a7) == 0x5f00c800 and
    uint32(@h01+0x03df) == 0x61004d00
}
YARA Detection Rule: Cobaltbaltstrike_RAW_Payload_TCP_Reverse_x86_UTF16
Repository: Neo23x0/signature-base
Detects: Detects CobaltStrike payloads
Author: Avast Threat Intel Team
Reference: https://github.com/avast/ioc

Pattern signatures:
// x86 default eop utf-16
    $h01 = { FC 00 E8 00 89 00 00 00 00 00 00 00 60 00 89 00 E5 00 31 00 D2 00 64 00 8B 00 52 00 30 00 8B 00 52 00 0C 00 8B 00 52 00 14 00 8B 00 72 00 28 }

Detection condition:
uint32(@h01+0x013b) == 0x07002600 and
    uint32(@h01+0x015b) == 0x00006b00 and
    uint32(@h01+0x0179) == 0xe000df00 and
    uint32(@h01+0x01ad) == 0x61007400 and
    uint32(@h01+0x01cd) == 0x5600a200 and
    uint32(@h01+0x01e7) == 0x5f00c800 and
    uint32(@h01+0x020d) == 0xe5005300 and
    uint32

Full rule:
rule Cobaltbaltstrike_RAW_Payload_TCP_Reverse_x86_UTF16
{
  meta:
    author = "Avast Threat Intel Team"
    description = "Detects CobaltStrike payloads"
    reference = "https://github.com/avast/ioc"
    id = "321c1f3f-b7fc-5408-b460-6aa4423d381c"
  strings:
    // x86 default eop utf-16
    $h01 = { FC 00 E8 00 89 00 00 00 00 00 00 00 60 00 89 00 E5 00 31 00 D2 00 64 00 8B 00 52 00 30 00 8B 00 52 00 0C 00 8B 00 52 00 14 00 8B 00 72 00 28 }
  condition:
    uint32(@h01+0x013b) == 0x07002600 and
    uint32(@h01+0x015b) == 0x00006b00 and
    uint32(@h01+0x0179) == 0xe000df00 and
    uint32(@h01+0x01ad) == 0x61007400 and
    uint32(@h01+0x01cd) == 0x5600a200 and
    uint32(@h01+0x01e7) == 0x5f00c800 and
    uint32(@h01+0x020d) == 0xe5005300 and
    uint32(@h01+0x0229) == 0x5f00c800
}
YARA Detection Rule: Cobaltbaltstrike_RAW_Payload_TCP_Reverse_x64_UTF16
Repository: Neo23x0/signature-base
Detects: Detects CobaltStrike payloads
Author: Avast Threat Intel Team
Reference: https://github.com/avast/ioc

Pattern signatures:
// x64 default eop utf16
    $h01 = { FC 00 48 00 83 00 E4 00 F0 00 E8 00 C8 00 00 00 00 00 00 00 41 00 51 00 41 00 50 00 52 00 51 00 56 00 48 00 31 00 D2 00 65 00 48 00 8B 00 52 }

Detection condition:
uint32(@h01+0x0203) == 0x07002600 and
    uint32(@h01+0x0225) == 0x00006b00 and
    uint32(@h01+0x025d) == 0xe000df00 and
    uint32(@h01+0x0287) == 0x61007400 and
    uint32(@h01+0x02d9) == 0x5f00c800 and
    uint32(@h01+0x0319) == 0xe5005300 and
    uint32(@h01+0x034d) == 0x5f00c800 and
    uint32

Full rule:
rule Cobaltbaltstrike_RAW_Payload_TCP_Reverse_x64_UTF16
{
  meta:
    author = "Avast Threat Intel Team"
    description = "Detects CobaltStrike payloads"
    reference = "https://github.com/avast/ioc"
    id = "1cc2494c-1f39-5a72-93af-c267eaf768fe"
  strings:
    // x64 default eop utf16
    $h01 = { FC 00 48 00 83 00 E4 00 F0 00 E8 00 C8 00 00 00 00 00 00 00 41 00 51 00 41 00 50 00 52 00 51 00 56 00 48 00 31 00 D2 00 65 00 48 00 8B 00 52 }
  condition:
    uint32(@h01+0x0203) == 0x07002600 and
    uint32(@h01+0x0225) == 0x00006b00 and
    uint32(@h01+0x025d) == 0xe000df00 and
    uint32(@h01+0x0287) == 0x61007400 and
    uint32(@h01+0x02d9) == 0x5f00c800 and
    uint32(@h01+0x0319) == 0xe5005300 and
    uint32(@h01+0x034d) == 0x5f00c800 and
    uint32(@h01+0x0385) == 0x61004d00
}
YARA Detection Rule: Cobaltbaltstrike_RAW_Payload_http_stager_x86_UTF16
Repository: Neo23x0/signature-base
Detects: Detects CobaltStrike payloads
Author: Avast Threat Intel Team
Reference: https://github.com/avast/ioc

Pattern signatures:
// x86 default eop utf-16
    $h01 = { FC 00 E8 00 89 00 00 00 00 00 00 00 60 00 89 00 E5 00 31 00 D2 00 64 00 8B 00 52 00 30 00 8B 00 52 00 0C 00 8B 00 52 00 14 00 8B 00 72 00 28 }

Detection condition:
uint32(@h01+0x013b) == 0x07002600 and
    uint32(@h01+0x0157) == 0xa7007900 and
    uint32(@h01+0x018f) == 0xc6009f00 and
    uint32(@h01+0x01bf) == 0x3b002e00 and
    uint32(@h01+0x01e7) == 0x7b001800 and
    uint32(@h01+0x0219) == 0x5d00e200 and
    uint32(@h01+0x022b) == 0x31005e00 and
    uint32

Full rule:
rule Cobaltbaltstrike_RAW_Payload_http_stager_x86_UTF16
{
  meta:
    author = "Avast Threat Intel Team"
    description = "Detects CobaltStrike payloads"
    reference = "https://github.com/avast/ioc"
    id = "c1602e85-5b42-5005-a6d1-7140cb57a3c7"
  strings:
    // x86 default eop utf-16
    $h01 = { FC 00 E8 00 89 00 00 00 00 00 00 00 60 00 89 00 E5 00 31 00 D2 00 64 00 8B 00 52 00 30 00 8B 00 52 00 0C 00 8B 00 52 00 14 00 8B 00 72 00 28 }
  condition:
    uint32(@h01+0x013b) == 0x07002600 and
    uint32(@h01+0x0157) == 0xa7007900 and
    uint32(@h01+0x018f) == 0xc6009f00 and
    uint32(@h01+0x01bf) == 0x3b002e00 and
    uint32(@h01+0x01e7) == 0x7b001800 and
    uint32(@h01+0x0219) == 0x5d00e200 and
    uint32(@h01+0x022b) == 0x31005e00 and
    uint32(@h01+0x0249) == 0x0b00e000 and
    uint32(@h01+0x058b) == 0x5600a200 and
    uint32(@h01+0x05b3) == 0xe5005300 and
    uint32(@h01+0x05e9) == 0xe2008900
}
YARA Detection Rule: Cobaltbaltstrike_RAW_Payload_http_stager_x64_UTF16
Repository: Neo23x0/signature-base
Detects: Detects CobaltStrike payloads
Author: Avast Threat Intel Team
Reference: https://github.com/avast/ioc

Pattern signatures:
// x64 default eop utf16
    $h01 = { FC 00 48 00 83 00 E4 00 F0 00 E8 00 C8 00 00 00 00 00 00 00 41 00 51 00 41 00 50 00 52 00 51 00 56 00 48 00 31 00 D2 00 65 00 48 00 8B 00 52 }

Detection condition:
uint32(@h01+0x01d5) == 0x07002600 and
    uint32(@h01+0x0205) == 0xa7007900 and
    uint32(@h01+0x0243) == 0xc6009f00 and
    uint32(@h01+0x0281) == 0x3b002e00 and
    uint32(@h01+0x02c9) == 0x7b001800 and
    uint32(@h01+0x0613) == 0x5600a200 and
    uint32(@h01+0x064b) == 0xe5005300 and
    uint32

Full rule:
rule Cobaltbaltstrike_RAW_Payload_http_stager_x64_UTF16
{
  meta:
    author = "Avast Threat Intel Team"
    description = "Detects CobaltStrike payloads"
    reference = "https://github.com/avast/ioc"
    id = "78672e3b-6f76-573a-8a9a-610334baa389"
  strings:
    // x64 default eop utf16
    $h01 = { FC 00 48 00 83 00 E4 00 F0 00 E8 00 C8 00 00 00 00 00 00 00 41 00 51 00 41 00 50 00 52 00 51 00 56 00 48 00 31 00 D2 00 65 00 48 00 8B 00 52 }
  condition:
    uint32(@h01+0x01d5) == 0x07002600 and
    uint32(@h01+0x0205) == 0xa7007900 and
    uint32(@h01+0x0243) == 0xc6009f00 and
    uint32(@h01+0x0281) == 0x3b002e00 and
    uint32(@h01+0x02c9) == 0x7b001800 and
    uint32(@h01+0x0613) == 0x5600a200 and
    uint32(@h01+0x064b) == 0xe5005300 and
    uint32(@h01+0x0687) == 0xe2008900
}
YARA Detection Rule: Cobaltbaltstrike_RAW_Payload_https_stager_x86_UTF16
Repository: Neo23x0/signature-base
Detects: Detects CobaltStrike payloads
Author: Avast Threat Intel Team
Reference: https://github.com/avast/ioc

Pattern signatures:
// x86 default eop utf-16
    $h01 = { FC 00 E8 00 89 00 00 00 00 00 00 00 60 00 89 00 E5 00 31 00 D2 00 64 00 8B 00 52 00 30 00 8B 00 52 00 0C 00 8B 00 52 00 14 00 8B 00 72 00 28 }

Detection condition:
uint32(@h01+0x013b) == 0x07002600 and
    uint32(@h01+0x0161) == 0xa7007900 and
    uint32(@h01+0x0199) == 0xc6009f00 and
    uint32(@h01+0x01d1) == 0x3b002e00 and
    uint32(@h01+0x0203) == 0x86009e00 and
    uint32(@h01+0x0223) == 0x7b001800 and
    uint32(@h01+0x0255) == 0x5d00e200 and
    uint32

Full rule:
rule Cobaltbaltstrike_RAW_Payload_https_stager_x86_UTF16
{
  meta:
    author = "Avast Threat Intel Team"
    description = "Detects CobaltStrike payloads"
    reference = "https://github.com/avast/ioc"
    id = "dcd3e5c8-7626-5a78-9f90-7a8e67311d90"
  strings:
    // x86 default eop utf-16
    $h01 = { FC 00 E8 00 89 00 00 00 00 00 00 00 60 00 89 00 E5 00 31 00 D2 00 64 00 8B 00 52 00 30 00 8B 00 52 00 0C 00 8B 00 52 00 14 00 8B 00 72 00 28 }
  condition:
    uint32(@h01+0x013b) == 0x07002600 and
    uint32(@h01+0x0161) == 0xa7007900 and
    uint32(@h01+0x0199) == 0xc6009f00 and
    uint32(@h01+0x01d1) == 0x3b002e00 and
    uint32(@h01+0x0203) == 0x86009e00 and
    uint32(@h01+0x0223) == 0x7b001800 and
    uint32(@h01+0x0255) == 0x5d00e200 and
    uint32(@h01+0x0267) == 0x31005e00 and
    uint32(@h01+0x0285) == 0x0b00e000 and
    uint32(@h01+0x05d5) == 0x5600a200 and
    uint32(@h01+0x05fd) == 0xe5005300 and
    uint32(@h01+0x0633) == 0xe2008900
}
YARA Detection Rule: Cobaltbaltstrike_RAW_Payload_https_stager_x64_UTF16
Repository: Neo23x0/signature-base
Detects: Detects CobaltStrike payloads
Author: Avast Threat Intel Team
Reference: https://github.com/avast/ioc

Pattern signatures:
// x64 default eop utf-16
    $h01 = { FC 00 48 00 83 00 E4 00 F0 00 E8 00 C8 00 00 00 00 00 00 00 41 00 51 00 41 00 50 00 52 00 51 00 56 00 48 00 31 00 D2 00 65 00 48 00 8B 00 52 }

Detection condition:
uint32(@h01+0x01d5) == 0x07002600 and
    uint32(@h01+0x0205) == 0xa7007900 and
    uint32(@h01+0x0249) == 0xc6009f00 and
    uint32(@h01+0x0287) == 0x3b002e00 and
    uint32(@h01+0x02db) == 0x86009e00 and
    uint32(@h01+0x030f) == 0x7b001800 and
    uint32(@h01+0x0659) == 0x5600a200 and
    uint32

Full rule:
rule Cobaltbaltstrike_RAW_Payload_https_stager_x64_UTF16
{
  meta:
    author = "Avast Threat Intel Team"
    description = "Detects CobaltStrike payloads"
    reference = "https://github.com/avast/ioc"
    id = "aa93dd56-9589-5958-9711-ca2f9c763665"
  strings:
    // x64 default eop utf-16
    $h01 = { FC 00 48 00 83 00 E4 00 F0 00 E8 00 C8 00 00 00 00 00 00 00 41 00 51 00 41 00 50 00 52 00 51 00 56 00 48 00 31 00 D2 00 65 00 48 00 8B 00 52 }
  condition:
    uint32(@h01+0x01d5) == 0x07002600 and
    uint32(@h01+0x0205) == 0xa7007900 and
    uint32(@h01+0x0249) == 0xc6009f00 and
    uint32(@h01+0x0287) == 0x3b002e00 and
    uint32(@h01+0x02db) == 0x86009e00 and
    uint32(@h01+0x030f) == 0x7b001800 and
    uint32(@h01+0x0659) == 0x5600a200 and
    uint32(@h01+0x0691) == 0xe5005300 and
    uint32(@h01+0x06cd) == 0xe2008900
}