HackTool - CobaltStrike BOF Injection Pattern

Title: HackTool - CobaltStrike BOF Injection Pattern
Status: test
Description:Detects a typical pattern of a CobaltStrike BOF which inject into other processes
References:
  -https://github.com/boku7/injectAmsiBypass
  -https://github.com/boku7/spawn
Author: Christian Burkard (Nextron Systems)
Date: 2021-08-04
modified:2023-11-28
Tags:

• -'attack.execution'
• -'attack.defense-impairment'
• -'attack.t1106'
• -'attack.t1685'

Logsource:

• category: process_access
• product: windows

Detection:
  selection:
    CallTrace|re: '^C:\\Windows\\SYSTEM32\\ntdll\.dll\+[a-z0-9]{4,6}\|C:\\Windows\\System32\\KERNELBASE\.dll\+[a-z0-9]{4,6}\|UNKNOWN\([A-Z0-9]{16}\)$'
    GrantedAccess:
      -'0x1028'
      -'0x1fffff'

  condition:selection
Falsepositives:
  -Unknown
Level: high