Volatility3 MCP Server

/* This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license. */ rule Cobalt_functions { meta: author="@j0sm1" url="https://www.securityartwork.es/2017/06/16/analisis-del-powershell-usado-fin7/" description="Detect functions coded with ROR edi,D; Detect CobaltStrike used by differents groups APT" strings: $h1={58 A4 53 E5} // VirtualAllocEx $h2={4C 77 26 07} // LoadLibraryEx $h3={6A C9 9C C9} // DNSQuery_UTF8 $h4={44 F0 35 E0} // Sleep $h5={F4 00 8E CC} // lstrlen condition: 2 of ( $h* ) }