GCTI_Sliver_Implant_64Bit

rule GCTI_Sliver_Implant_64Bit
{
	meta:
		description = "Sliver 64-bit implant (with and without --debug flag at compile)"
		author = "gssincla@google.com"
		id = "b84db933-0e11-5871-821d-43697c015665"
		date = "2022-11-18"
		modified = "2022-11-19"
		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/Sliver/Sliver__Implant_64bit.yara#L17-L84"
		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
		hash = "2d1c9de42942a16c88a042f307f0ace215cdc67241432e1152080870fe95ea87"
		logic_hash = "ad4ceef08a732174c8ccbcacf0370b26acb9e5ec0784d8827c8104618e018a26"
		score = 75
		quality = 85
		tags = ""

	strings:
		$s_tcppivot = { 48 ?? 74 63 70 70 69 76 6F 74 }
		$s_namedpipe = { 48 ?? 6E 61 6D 65 64 70 69 70 [2-32] 80 ?? 08 65 }
		$s_https = { 81 ?? 68 74 74 70 [2-32] 80 ?? 04 73 }
		$s_wg = {66 81 ?? 77 67}
		$s_dns = { 66 81 ?? 64 6E [2-20] 80 ?? 02 73 }
		$s_mtls = {  81 ?? 6D 74 6C 73  }
		$fp1 = "cloudfoundry" ascii fullword

	condition:
		5 of ( $s* ) and not 1 of ( $fp* )
}