HackTool - CobaltStrike Malleable Profile Patterns - Proxy

calendar Aug 12, 2024 · attack.defense-evasion attack.command-and-control attack.t1071.001  ·
Share on: linkedin copy

Detects cobalt strike malleable profiles patterns (URI, User-Agents, Methods).

Sigma rule (View on GitHub)

 1title: HackTool - CobaltStrike Malleable Profile Patterns - Proxy
 2id: f3f21ce1-cdef-4bfc-8328-ed2e826f5fac
 3related:
 4    - id: 953b895e-5cc9-454b-b183-7f3db555452e
 5      type: obsolete
 6    - id: 41b42a36-f62c-4c34-bd40-8cb804a34ad8
 7      type: obsolete
 8    - id: 37325383-740a-403d-b1a2-b2b4ab7992e7
 9      type: obsolete
10    - id: c9b33401-cc6a-4cf6-83bb-57ddcb2407fc
11      type: obsolete
12status: test
13description: Detects cobalt strike malleable profiles patterns (URI, User-Agents, Methods).
14references:
15    - https://github.com/rsmudge/Malleable-C2-Profiles/blob/26323784672913923d20c5a638c6ca79459e8529/normal/amazon.profile
16    - https://www.hybrid-analysis.com/sample/ee5eca8648e45e2fea9dac0d920ef1a1792d8690c41ee7f20343de1927cc88b9?environmentId=100
17    - https://github.com/rsmudge/Malleable-C2-Profiles/blob/26323784672913923d20c5a638c6ca79459e8529/normal/ocsp.profile
18    - https://github.com/yeyintminthuhtut/Malleable-C2-Profiles-Collection/
19    - https://github.com/rsmudge/Malleable-C2-Profiles/blob/26323784672913923d20c5a638c6ca79459e8529/normal/onedrive_getonly.profile
20author: Markus Neis, Florian Roth (Nextron Systems)
21date: 2024-02-15
22tags:
23    - attack.defense-evasion
24    - attack.command-and-control
25    - attack.t1071.001
26logsource:
27    category: proxy
28detection:
29    selection_amazon_1:
30        c-useragent: 'Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko'
31        cs-method: 'GET'
32        c-uri: '/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books'
33        cs-host: 'www.amazon.com'
34        cs-cookie|endswith: '=csm-hit=s-24KU11BB82RZSYGJ3BDK|1419899012996'
35    selection_amazon_2:
36        c-useragent: 'Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko'
37        cs-method: 'POST'
38        c-uri: '/N4215/adj/amzn.us.sr.aps'
39        cs-host: 'www.amazon.com'
40    selection_generic_1:
41        c-useragent:
42            - 'Mozilla/4.0 (compatible; MSIE 6.0;Windows NT 5.1)'
43            - 'Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E )'
44            - 'Mozilla/5.0 (Windows; U; MSIE 7.0; Windows NT 5.2) Java/1.5.0_08'
45    selection_generic_2:
46        c-useragent|endswith: '; MANM; MANM)'
47    selection_oscp:
48        c-uri|contains: '/oscp/'
49        cs-host: 'ocsp.verisign.com'
50    selection_onedrive:
51        cs-method: 'GET'
52        c-uri|endswith: '\?manifest=wac'
53        cs-host: 'onedrive.live.com'
54    filter_main_onedrive:
55        c-uri|startswith: 'http'
56        c-uri|contains: '://onedrive.live.com/'
57    condition: 1 of selection_* and not 1 of filter_main_*
58falsepositives:
59    - Unknown
60level: high

References

Related rules

to-top