YARA rules for Cobalt Strike

Detects Cobalt Strike beacon loader

Detects static bytes in Cobalt Strike 4.5 sleep mask function that are not obfuscated

No description has been set in the source file - AvastTI

No description has been set in the source file - AvastTI

No description has been set in the source file - AvastTI

No description has been set in the source file - AvastTI

No description has been set in the source file - AvastTI

No description has been set in the source file - AvastTI

No description has been set in the source file - AvastTI

No description has been set in the source file - AvastTI

No description has been set in the source file - AvastTI

No description has been set in the source file - AvastTI

No description has been set in the source file - AvastTI

No description has been set in the source file - AvastTI

No description has been set in the source file - AvastTI

No description has been set in the source file - AvastTI

No description has been set in the source file - AvastTI

No description has been set in the source file - AvastTI

No description has been set in the source file - AvastTI

No description has been set in the source file - AvastTI

No description has been set in the source file - AvastTI

No description has been set in the source file - AvastTI

No description has been set in the source file - AvastTI

No description has been set in the source file - AvastTI

No description has been set in the source file - AvastTI

No description has been set in the source file - AvastTI

No description has been set in the source file - AvastTI

Cobalt Strike's resources/artifact32{.exe,.dll,big.exe,big.dll} and resources/dropper.exe signature for versions 1.49 to 3.14

Cobalt Strike's resources/artifact32{.dll,.exe,svc.exe,big.exe,big.dll,bigsvc.exe} and resources/artifact32uac(alt).dll signature for versions 3.1 and 3.2

Cobalt Strike's resources/artifact32{.dll,.exe,big.exe,big.dll,bigsvc.exe} signature for versions 3.14 to 4.x and resources/artifact32svc.exe for 3.14 to 4.x and resources/artifact32uac.dll for v3.14 and v4.0

Cobalt Strike's resources/artifact32svc(big).exe signature for versions 3.1 and 3.2 (with overlap with v3.14 through v4.x)

Cobalt Strike's resources/artifact64{.dll,.exe,big.exe,big.dll,bigsvc.exe,big.x64.dll} and resources/rtifactuac(alt)64.dll signature for versions v1.49, v2.x, v3.0, and v3.3 through v3.14

Cobalt Strike's resources/artifact64{svcbig.exe,.dll,big.dll,svc.exe} and resources/artifactuac(big)64.dll signature for versions 3.14 to 4.x and resources/artifact32svc.exe for 3.14 to 4.x

Cobalt Strike's resources/artifact64{.exe,.dll,svc.exe,svcbig.exe,big.exe,big.dll,.x64.dll,big.x64.dll} and resource/artifactuac(alt)64.exe signature for versions v3.14 through v4.x

Cobalt Strike's resources/beacon.dll Version 1.44

Cobalt Strike's resources/beacon.dll Version 1.45

Cobalt Strike's resources/beacon.dll Version 1.46

Cobalt Strike's resources/beacon.dll Version 1.47

Cobalt Strike's resources/beacon.dll Version 1.48

Cobalt Strike's resources/beacon.dll Version 1.49

Cobalt Strike's resources/beacon.dll Version 2.0.49

Cobalt Strike's resources/beacon.dll Versions 2.1 and 2.2

Cobalt Strike's resources/beacon.dll Versions 2.3

Cobalt Strike's resources/beacon.dll Versions 2.4

Cobalt Strike's resources/beacon.dll Versions 2.5

Cobalt Strike's resources/beacon.dll Versions 3.0

Cobalt Strike's resources/beacon.dll Versions 3.1

Cobalt Strike's resources/beacon.dll Versions 3.11

Cobalt Strike's resources/beacon.dll Versions 3.11-bugfix and 3.12

Cobalt Strike's resources/beacon.dll Versions 3.13

Cobalt Strike's resources/beacon.dll Versions 3.14

Cobalt Strike's resources/beacon.dll Versions 3.2

Cobalt Strike's resources/beacon.dll Versions 3.3

Cobalt Strike's resources/beacon.dll Versions 3.4

Cobalt Strike's resources/beacon.dll Versions 3.5-hf1 and 3.5.1 (3.5.x)

Cobalt Strike's resources/beacon.dll Versions 3.6

Cobalt Strike's resources/beacon.dll Versions 3.7

Cobalt Strike's resources/beacon.dll Versions 3.8

Cobalt Strike's sleeve/beacon.x64.dll Versions 3.11 (two subversions)

Cobalt Strike's sleeve/beacon.x64.dll Versions 3.12

Cobalt Strike's sleeve/beacon.x64.dll Versions 3.13

Cobalt Strike's sleeve/beacon.x64.dll Versions 3.14

Cobalt Strike's sleeve/beacon.x64.dll Versions 3.2

Cobalt Strike's sleeve/beacon.x64.dll Versions 3.3

Cobalt Strike's sleeve/beacon.x64.dll Versions 3.4

Cobalt Strike's sleeve/beacon.x64.dll Versions 3.5-hf1 and 3.5.1

Cobalt Strike's sleeve/beacon.x64.dll Versions 3.6

Cobalt Strike's sleeve/beacon.x64.dll Versions 3.7

Cobalt Strike's sleeve/beacon.x64.dll Versions 3.8

Cobalt Strike's resources/bind.bin signature for versions 2.5 to 4.x

Cobalt Strike's resources/bind64.bin signature for versions v2.5 to v4.x

Cobalt Strike's resources/browserpivot.bin from v1.48 to v3.14 and sleeve/browserpivot.dll from v4.0 to at least v4.4

Cobalt Strike's resources/browserpivot.x64.bin from v1.48 to v3.14 and sleeve/browserpivot.x64.dll from v4.0 to at least v4.4

Cobalt Strike's resources/bypassuac(-x86).dll from v1.49 to v3.14 (32-bit version) and sleeve/bypassuac.dll from v4.0 to at least v4.4

Cobalt Strike's resources/bypassuac-x64.dll from v3.3 to v3.14 (64-bit version) and sleeve/bypassuac.x64.dll from v4.0 to at least v4.4

Cobalt Strike's resources/bypassuactoken.dll from v3.11 to v3.14 (32-bit version)

Cobalt Strike's resources/bypassuactoken.x64.dll from v3.11 to v3.14 (64-bit version)

Cobalt Strike's resources/command.ps1 for versions 2.5 to v3.7 and resources/compress.ps1 from v3.8 to v4.x

Cobalt Strike's resources/covertvpn.dll signature for version v2.2 to v4.4

Cobalt Strike's resources/covertvpn-injector.exe signature for version v1.44 to v2.0.49

Cobalt Strike's resources/elevate.dll signature for v3.0 to v3.14 and sleeve/elevate.dll for v4.x

Cobalt Strike's resources/elevate.x64.dll signature for v3.0 to v3.14 and sleeve/elevate.x64.dll for v4.x

Cobalt Strike's resources/httpsstager.bin signature for versions 2.5 to 4.x

Cobalt Strike's resources/httpsstager64.bin signature for versions v3.2 to v4.x

Cobalt Strike's resources/httpstager.bin signature for versions 2.5 to 4.x

Cobalt Strike's resources/httpstager64.bin signature for versions v3.2 to v4.x

Cobalt Strike's resources/reverse.bin signature for versions 2.5 to 4.x

Cobalt Strike's resources/reverse64.bin signature for versions v2.5 to v4.x

Cobalt Strike's resources/smbstager.bin signature for versions 2.5 to 4.x

Cobalt Strike's resources/template.py signature for versions v3.3 to v4.x

Cobalt Strike's resources/template.sct signature for versions v3.3 to v4.x

Cobalt Strike's resources/template.x64.ps1, resources/template.x32 from v3.11 to v3.14 and resources/template.ps1 from v1.45 to v2.5

Cobalt Strike's resources/template.x86.vba signature for versions v3.8 to v4.x

Cobalt Strike's resource/xor64.bin signature for version 3.12 through 4.x

Cobalt Strike's resource/xor.bin signature for version 2.x through 4.x

Cobalt Strike's sleeve/beacon.dll Versions 4.0 (suspected, not confirmed)

Cobalt Strike's sleeve/beacon.dll Versions 4.1 and 4.2

Cobalt Strike's sleeve/beacon.dll Versions 4.3 and 4.4

Cobalt Strike's sleeve/beacon.dll Versions 4.7 (suspected, not confirmed)

Cobalt Strike's sleeve/beacon.x64.dll Versions 4.0 (suspected, not confirmed)

Cobalt Strike's sleeve/beacon.x64.dll Versions 4.1 and 4.2

Cobalt Strike's sleeve/beacon.x64.dll Version 4.3

Cobalt Strike's sleeve/beacon.x64.dll Versions 4.4 through at least 4.6

Cobalt Strike's sleeve/beacon.x64.dll Versions 4.5 (variant)

Cobalt Strike's sleeve/BeaconLoader.HA.x64.o (HeapAlloc) Versions 4.3 through at least 4.6

Cobalt Strike's sleeve/BeaconLoader.HA.x86.o (HeapAlloc) Versions 4.3 through at least 4.6

Cobalt Strike's sleeve/BeaconLoader.MVF.x64.o (MapViewOfFile) Versions 4.3 through at least 4.6

Cobalt Strike's sleeve/BeaconLoader.MVF.x86.o (MapViewOfFile) Versions 4.3 through at least 4.6

Cobalt Strike's sleeve/BeaconLoader.VA.x64.o (VirtualAlloc) Versions 4.3 through at least 4.6

Cobalt Strike's sleeve/BeaconLoader.VA.x86.o (VirtualAlloc) Versions 4.3 through at least 4.6

Cobalt Strike's sleeve/BeaconLoader.x64.o (Base) Versions 4.3 through at least 4.6

Cobalt Strike's sleeve/BeaconLoader.x86.o Versions 4.3 through at least 4.6

Cobalt Strike's resources/beacon.dll Versions 3.8

Detects CobaltStrike MZ header ReflectiveLoader launcher

Detects CobaltStrike sleep_mask decoder

Identifies deobfuscation routine used in Cobalt Strike Beacon DLL version 4.2

Identifies strings used in Cobalt Strike Beacon DLL

Identifies XOR'd strings used in Cobalt Strike Beacon DLL

The CobaltStrike malware family.

Cobalt Strike's resources/template.x64.ps1, resources/template.hint.x64.ps1 and resources/template.hint.x32.ps1 from v3.0 to v4.x except 3.12 and 3.13

A loader for the CobaltStrike malware family, which ultimately takes the first and second bytes of an embedded file, and flips them prior to executing the resulting payload.

The CobaltStrike malware family, variant D.

autogenerated rule brought to you by yara-signator

Detection of an encoder observed with Cobalt Strike shellcode

Detects default strings related to cobalt strike named pipes

Rule to detect CobaltStrike beacon

Cobalt Strike's resources/dnsstager.bin signature for versions 1.47 to 4.x

Cobalt Strike's resources/btemplate.vbs signature for versions v3.3 to v4.x

Detect the SideWinder malware

Detect Cobalt Strike implant