Yara Rule - Cobaltstrike 4.9.1 이상에서 사용되는 Opcodes에 대한 사냥
Yara 정의.
Yara Rule - Hunts for opcodes used in Cobaltstrike 4.9.1 and earlier
Yara definition.
Author: @ninjaparanoid
https://github.com/paranoidninja/Cobaltstrike-Detection/blob/main/cs49.yara
version = "0.1"
date = "2023-10-12"
score = 75
$socks = { 49 8D 55 02 48 8D 4C 24 30 44 0F B7 F8 B8 FF 03 00 00 }
$core = { 49 B9 01 01 01 01 01 01 01 01 49 0F AF D1 49 83 F8 40 }```
[https://github.com/Neo23x0/signature-base/commit/2f5a581b6b5e9403776bde22ef7968fb45b2030a](https://github.com/Neo23x0/signature-base/commit/2f5a581b6b5e9403776bde22ef7968fb45b2030a)