{"id":"f3f21ce1-cdef-4bfc-8328-ed2e826f5fac","title":"HackTool - CobaltStrike Malleable Profile Patterns - Proxy","description":"Detects cobalt strike malleable profiles patterns (URI, User-Agents, Methods).","author":"Markus Neis, Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2024-02-15","modified":"","tags":["attack.command-and-control","attack.t1071.001"],"technique_ids":["T1071.001"],"logsource":{"category":"proxy"},"falsepositives":["Unknown"],"references":["https://github.com/rsmudge/Malleable-C2-Profiles/blob/26323784672913923d20c5a638c6ca79459e8529/normal/amazon.profile","https://www.hybrid-analysis.com/sample/ee5eca8648e45e2fea9dac0d920ef1a1792d8690c41ee7f20343de1927cc88b9?environmentId=100","https://github.com/rsmudge/Malleable-C2-Profiles/blob/26323784672913923d20c5a638c6ca79459e8529/normal/ocsp.profile","https://github.com/yeyintminthuhtut/Malleable-C2-Profiles-Collection/","https://github.com/rsmudge/Malleable-C2-Profiles/blob/26323784672913923d20c5a638c6ca79459e8529/normal/onedrive_getonly.profile"],"source_path":"rules/web/proxy_generic/proxy_hktl_cobalt_strike_malleable_c2_requests.yml","source_sha256":"f8e4e43e7b39def92f12dcc9ef8263832374e3eef4f7a750aa994e4d6a8d5dc5","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/web/proxy_generic/proxy_hktl_cobalt_strike_malleable_c2_requests.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: HackTool - CobaltStrike Malleable Profile Patterns - Proxy\nid: f3f21ce1-cdef-4bfc-8328-ed2e826f5fac\nrelated:\n    - id: 953b895e-5cc9-454b-b183-7f3db555452e\n      type: obsolete\n    - id: 41b42a36-f62c-4c34-bd40-8cb804a34ad8\n      type: obsolete\n    - id: 37325383-740a-403d-b1a2-b2b4ab7992e7\n      type: obsolete\n    - id: c9b33401-cc6a-4cf6-83bb-57ddcb2407fc\n      type: obsolete\nstatus: test\ndescription: Detects cobalt strike malleable profiles patterns (URI, User-Agents, Methods).\nreferences:\n    - https://github.com/rsmudge/Malleable-C2-Profiles/blob/26323784672913923d20c5a638c6ca79459e8529/normal/amazon.profile\n    - https://www.hybrid-analysis.com/sample/ee5eca8648e45e2fea9dac0d920ef1a1792d8690c41ee7f20343de1927cc88b9?environmentId=100\n    - https://github.com/rsmudge/Malleable-C2-Profiles/blob/26323784672913923d20c5a638c6ca79459e8529/normal/ocsp.profile\n    - https://github.com/yeyintminthuhtut/Malleable-C2-Profiles-Collection/\n    - https://github.com/rsmudge/Malleable-C2-Profiles/blob/26323784672913923d20c5a638c6ca79459e8529/normal/onedrive_getonly.profile\nauthor: Markus Neis, Florian Roth (Nextron Systems)\ndate: 2024-02-15\ntags:\n    - attack.command-and-control\n    - attack.t1071.001\nlogsource:\n    category: proxy\ndetection:\n    selection_amazon_1:\n        c-useragent: 'Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko'\n        cs-method: 'GET'\n        c-uri: '/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books'\n        cs-host: 'www.amazon.com'\n        cs-cookie|endswith: '=csm-hit=s-24KU11BB82RZSYGJ3BDK|1419899012996'\n    selection_amazon_2:\n        c-useragent: 'Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko'\n        cs-method: 'POST'\n        c-uri: '/N4215/adj/amzn.us.sr.aps'\n        cs-host: 'www.amazon.com'\n    selection_generic_1:\n        c-useragent:\n            - 'Mozilla/4.0 (compatible; MSIE 6.0;Windows NT 5.1)'\n            - 'Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E )'\n            - 'Mozilla/5.0 (Windows; U; MSIE 7.0; Windows NT 5.2) Java/1.5.0_08'\n    selection_generic_2:\n        c-useragent|endswith: '; MANM; MANM)'\n    selection_oscp:\n        c-uri|contains: '/oscp/'\n        cs-host: 'ocsp.verisign.com'\n    selection_onedrive:\n        cs-method: 'GET'\n        c-uri|endswith: '\\?manifest=wac'\n        cs-host: 'onedrive.live.com'\n    filter_main_onedrive:\n        c-uri|startswith: 'http'\n        c-uri|contains: '://onedrive.live.com/'\n    condition: 1 of selection_* and not 1 of filter_main_*\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1071.001","id":"T1071.001","name":"Web Protocols","page":"techniques/enterprise/T1071.001/"}],"data_path":"data/detection-rules/f3f21ce1-cdef-4bfc-8328-ed2e826f5fac.json","kind":"sigma"}