disable CS rule

phantinuss · Oct 13, 2023 · 857ac87 · 857ac87
1 parent 2f5a581
commit 857ac87
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/yara/gen_cobaltstrike.yar b/yara/gen_cobaltstrike.yar
@@ -22,6 +22,8 @@ rule HKTL_CobaltStrike_SleepMask_Jul22 {
 // This yara was specially crafted for the core (in-memory scans) which cannot be
 // avoided in way by an operator, making the malleability, UDRL or IAT hooking useless
 
+/* FR: rule caused 6490 false positives in our testing environment - cannot be used in the current form
+
 rule HKTL_CobaltStrike_CS_Core_Oct23 {
     meta:
         description = "Hunts for opcodes used in Cobaltstrike 4.9.1 and earlier"
@@ -36,3 +38,4 @@ rule HKTL_CobaltStrike_CS_Core_Oct23 {
     condition:
         1 of them
 }
+*/