Skip to content
yararules.org
Menu

YARA · Google Cloud Threat Intelligence (GCTI)

GCTI_Sliver_Implant_64Bit

Sliver 64-bit implant (with and without --debug flag at compile)

Hack toolGoogle Cloud Threat Intelligence (GCTI)Apache License 2.0Compiles with YARA-X
Author
gssincla@google.com
Date
2022-11-18
Modified
2022-11-19
Score / Quality
75 / 85

What this rule detects

Sliver 64-bit implant (with and without --debug flag at compile)

It defines 7 patterns (1 text, 6 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar
sliver-implant-64bit.yarApache License 2.0
rule GCTI_Sliver_Implant_64Bit
{
	meta:
		description = "Sliver 64-bit implant (with and without --debug flag at compile)"
		author = "gssincla@google.com"
		id = "b84db933-0e11-5871-821d-43697c015665"
		date = "2022-11-18"
		modified = "2022-11-19"
		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/Sliver/Sliver__Implant_64bit.yara#L17-L84"
		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
		hash = "2d1c9de42942a16c88a042f307f0ace215cdc67241432e1152080870fe95ea87"
		logic_hash = "ad4ceef08a732174c8ccbcacf0370b26acb9e5ec0784d8827c8104618e018a26"
		score = 75
		quality = 85
		tags = ""

	strings:
		$s_tcppivot = { 48 ?? 74 63 70 70 69 76 6F 74 }
		$s_namedpipe = { 48 ?? 6E 61 6D 65 64 70 69 70 [2-32] 80 ?? 08 65 }
		$s_https = { 81 ?? 68 74 74 70 [2-32] 80 ?? 04 73 }
		$s_wg = {66 81 ?? 77 67}
		$s_dns = { 66 81 ?? 64 6E [2-20] 80 ?? 02 73 }
		$s_mtls = {  81 ?? 6D 74 6C 73  }
		$fp1 = "cloudfoundry" ascii fullword

	condition:
		5 of ( $s* ) and not 1 of ( $fp* )
}

Strings (7 patterns)

IdentifierTypeValueModifiers
$s_tcppivothex{ 48 ?? 74 63 70 70 69 76 6F 74 }
$s_namedpipehex{ 48 ?? 6E 61 6D 65 64 70 69 70 [2-32] 80 ?? 08 65 }
$s_httpshex{ 81 ?? 68 74 74 70 [2-32] 80 ?? 04 73 }
$s_wghex{66 81 ?? 77 67}
$s_dnshex{ 66 81 ?? 64 6E [2-20] 80 ?? 02 73 }
$s_mtlshex{ 81 ?? 6D 74 6C 73 }
$fp1text"cloudfoundry"ascii fullword

Condition

5 of ( $s* ) and not 1 of ( $fp* )

In plain words (Heuristic)

  • At least 5 patterns in ( $s* ) must match.
  • At least 1 patterns in ( $fp* ) must match.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

Sample hashes

Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).

  • 2d1c9de42942a16c88a042f307f0ace215cdc67241432e1152080870fe95ea87

Licence & attribution

Author: gssincla@google.com

Source repository: Google Cloud Threat Intelligence (GCTI) @ 1c5fd42b18

Licence: Apache License 2.0 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: b84db933-0e11-5871-821d-43697c015665

Related rules