Signature Base unknown stable yara

CobaltStrike_C2_Host_Indicator [yara]

Detects CobaltStrike C2 host artifacts

View Source

Detection Logic

$c2_indicator and not $c2_indicator_fp
		and not uint32(0) == 0x0a786564
		and not uint32(0) == 0x0a796564

Field Validations

Loading…

Comments (0)

Loading comments...