SIGNATURE_BASE_Sliver_Implant_64Bit_1

import "pe"

rule SIGNATURE_BASE_Sliver_Implant_64Bit_1
{
	meta:
		description = "Sliver 64-bit implant (with and without --debug flag at compile)"
		author = "gssincla@google.com"
		id = "b84db933-0e11-5871-821d-43697c015665"
		date = "2022-11-18"
		modified = "2025-03-21"
		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_gcti_sliver.yar#L112-L183"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		hash = "2d1c9de42942a16c88a042f307f0ace215cdc67241432e1152080870fe95ea87"
		logic_hash = "ccfd944a5bc6521c89d44572910e2998e2404d472a593f9d97224d606d247bcd"
		score = 75
		quality = 85
		tags = ""

	strings:
		$s_tcppivot = { 48 ?? 74 63 70 70 69 76 6F 74 }
		$s_namedpipe = { 48 ?? 6E 61 6D 65 64 70 69 70 [2-32] 80 ?? 08 65 }
		$s_https = { 81 ?? 68 74 74 70 [2-32] 80 ?? 04 73 }
		$s_wg = {66 81 ?? 77 67}
		$s_dns = { 66 81 ?? 64 6E [2-20] 80 ?? 02 73 }
		$s_mtls = {  81 ?? 6D 74 6C 73  }
		$fp1 = "cloudfoundry" ascii fullword
		$fp2 = "googleapi.Error" ascii

	condition:
		5 of ( $s* ) and not 1 of ( $fp* ) and not pe.number_of_signatures > 0
}