AVASTTI_Cobaltstrike_Beacon_X64

rule AVASTTI_Cobaltstrike_Beacon_X64
{
	meta:
		description = "No description has been set in the source file - AvastTI"
		author = "Gen Threat Labs"
		id = "5d6d86ec-9e05-5596-b623-30f44c6f44db"
		date = "2021-07-08"
		modified = "2026-03-11"
		reference = "https://github.com/gendigitalinc/ioc"
		source_url = "https://github.com/avast/ioc/blob/a450ddabed95984422909c75ac52b6841f685983/CobaltStrike/yara_rules/cs_rules.yar#L634-L651"
		license_url = "N/A"
		logic_hash = "7abf5f9a337c60944a52efcc7a16a768652c46843d2da3df2f946dd6e63f9375"
		score = 75
		quality = 90
		tags = ""

	strings:
		$h01 = { 4D 5A 41 52 55 48 89 E5 48 81 EC 20 00 00 00 48 8D 1D EA FF FF FF 48 89 }
		$h11 = { 00 01 00 01 00 02 ?? ?? 00 02 00 01 00 02 ?? ?? 00 }
		$h12 = { 69 68 69 68 69 6B ?? ?? 69 6B 69 68 69 6B ?? ?? 69 }
		$h13 = { 2E 2F 2E 2F 2E 2C ?? ?? 2E 2C 2E 2F 2E 2C ?? ?? 2E }

	condition:
		$h01 and any of ( $h1* )
}