YARA · Arkbird SOLG (DailyIOC)
ARKBIRD_SOLG_MAL_Cobaltstrike_Oct_2021_1
Detect Cobalt Strike implant
- Author
- Arkbird_SOLG
- Date
- 2021-10-30
- Score / Quality
- 75 / 75
What this rule detects
Detect Cobalt Strike implant
Associated malware family: Cobalt Strike.
Targets: Windows PE.
It defines 4 patterns (0 text, 4 hex, 0 regex).
Summary generated from the rule's metadata and condition.
Rule source
Rule text not reproduced
This rule comes from Arkbird SOLG (DailyIOC), which does not grant a licence to redistribute its rules (No licence (all rights reserved)). We show its metadata only. Read the original rule upstream:
Sample hashes
Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).
- f520f97e3aa065efc4b7633735530a7ea341f3b332122921cb9257bf55147fb7
- 7370c09d07b4695aa11e299a9c17007e9267e1578ce2753259c02a8cf27b18b6
- bfbc1c27a73c33e375eeea164dc876c23bca1fbc0051bb48d3ed3e50df6fa0e8
Licence & attribution
Author: Arkbird_SOLG
Source repository: Arkbird SOLG (DailyIOC) @ a873ff1298
Licence: No licence (all rights reserved) (repository licence)
Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.
Rule id: 89d46993-cc1b-536b-b1ab-a0e967d0d397
Metadata
| tlp | white |
|---|---|
| adversary | - |
Tags:FILE
Related rules
- MalwareSignature Base (Florian Roth / Nextron)· X__Junior· 2026-02-02
- MalwareVolexity threat-intel· threatintel@volexity.com· 2021-05-25
- MalwareMalpedia signator rules· Felix Bilstein - yara-signator at cocacoding dot com· 2026-05-04
- MalwareTrellix Advanced Research Center· Felix Bilstein - yara-signator at cocacoding dot com· 2020-07-19
- MalwareSEKOIA.IO Community· Sekoia.io· 2022-10-24
- Hack toolSignature Base (Florian Roth / Nextron)· CodeX· 2022-07-04
- Hack toolAvast / Gen Digital IOC· Gen Threat Labs· 2021-07-08
- Hack toolAvast / Gen Digital IOC· Gen Threat Labs· 2021-07-08