Skip to content

Instantly share code, notes, and snippets.

@fox-srt

fox-srt/cobaltstrike-extraspace.rules

Created February 26, 2019 12:26
Show Gist options
  • Star 4 You must be signed in to star a gist
  • Fork 1 You must be signed in to fork a gist
  • Save fox-srt/6761b07f6fe7b8648de2debe5491c044 to your computer and use it in GitHub Desktop.
Save fox-srt/6761b07f6fe7b8648de2debe5491c044 to your computer and use it in GitHub Desktop.
Download ZIP
IDS Signature to detect the extraneous space in Cobalt Strike < 3.13
Raw
cobaltstrike-extraspace.rules
alert tcp any any -> any any (msg:"FOX-IT - Trojan - Possible CobaltStrike C2 Server"; \
flow:to_client; \
content:"HTTP/1.1 200 OK |0d0a|"; fast_pattern; depth:18; \
content:"Date: "; \
pcre:"/^HTTP/1.1 200 OK \r\nContent-Type: [^\r\n]{0,100}\r\nDate: [^\r\n]{0,100} GMT\r\n(Content-Length: \d+\r\n)\r\n/"; \
threshold:type limit, track by_dst, count 1, seconds 600; \
classtype:trojan-activity; priority:2; \
sid:21002217; rev:3;)
@fox-srt
Copy link
Author

fox-srt commented Apr 30, 2019

Full blog post here: https://blog.fox-it.com/2019/02/26/identifying-cobalt-strike-team-servers-in-the-wild/

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment