SEKOIA_Implant_Macos_Geacon

rule SEKOIA_Implant_Macos_Geacon : FILE
{
	meta:
		description = "Finds Geacon samples based on specific strings"
		author = "Sekoia.io"
		id = "a7784bfa-66a7-47df-b88b-d98217d8cca5"
		date = "2024-01-11"
		modified = "2024-12-19"
		reference = "https://www.sentinelone.com/blog/geacon-brings-cobalt-strike-capabilities-to-macos-threat-actors/"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/implant_macos_geacon.yar#L1-L35"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "284574d185d3777a373f4a19e0870eec5245fb8ea5ebd6124bc281f8c74e0998"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$gea01 = "geacon/config.init" ascii
		$gea02 = "geacon_pro-master/config/config.go" ascii
		$gea03 = "geacon_plus-main/config/config.go" ascii
		$gea04 = "command type %d is not support by geacon now" ascii
		$gea05 = "main/sysinfo.GeaconID" ascii
		$str01 = "command.StealToken" ascii
		$str02 = "command.MakeToken" ascii
		$str03 = "command/misc.go" ascii
		$str04 = "config/c2profile.go" ascii
		$str05 = "crypt.AesCBCDecrypt" ascii
		$str06 = "packet.File_Browse" ascii
		$str07 = "packet.FirstBlood" ascii
		$str08 = "packet.ParseCommandShell" ascii
		$str09 = "packet.ParseCommandUpload" ascii
		$str10 = "packet.PushResult" ascii
		$str11 = "sysinfo.GetComputerName" ascii
		$str12 = "sysinfo.IsOSX64" ascii
		$str13 = "util..inittask" ascii

	condition:
		uint32( 0 ) == 0xFEEDFACF and ( ( 1 of ( $gea* ) and 2 of ( $str* ) ) or 8 of ( $str* ) )
}