CobaltStrike YARA规则 检测 环境搭建

1、搭建环境

下载yara.exe可执行程序

Releases · VirusTotal/yara · GitHub

2、下载谷歌开源项目

https://github.com/chronicle/GCTI

3、运行cs木马，并记录pid

4、写个简单的脚本

import os
## https://github.com/chronicle/GCTI 项目下载后的目录
path = R"C:\Users\xxx\Desktop\test\GCTI\YARA\CobaltStrike"

def scan(path):
 
   file_list = os.listdir(path)
   
   for file in file_list:
       fullPath = os.path.join(path,file)
        ## yara.exe 路径
        ## 19684 为木马的pid，需要自己去替换
       cmd = R"D:\yara-4.2.3-2029-win64\yara64.exe " + fullPath + " 19684"
       result = os.popen(cmd).read()
       if result:
           print(result)
       
if __name__ == '__main__':
   scan(path)

5、测试