1. What kind of False Positives will this CobaltStrike rule generate?

rule MAL_CobaltStrike_StartW {

strings:

$a = "StartW" nocase

condition:

filesize < 10MB and $a

}


a. Rule could match (FP) on an antivirus security product
b. Rule could match (FP) on itself
c. Rule could match (FP) on a blog or webpage about the malware
d. Rule could match (FP) on anything with the string "startw" in it

2. How can you improve this CobaltStrike rule?

What changes to the rule below might improve the rule or reduce the chances of FPs?

rule MAL_CobaltStrike_StartW {

strings:

$a = "StartW" nocase

condition:

filesize < 10MB and $a

}


Select all that apply.
a. Perform a file header check for a value at offset 0, such as uint16be(0) == 0x4d5a
b. Reduce the filesize filter from 10MB down to < 5MB.
c. Change the string modifier from nocase to fullword to ensure it matches case sensitive and will avoid substring matching.
d. Be more precise about the expected location of the string using offsets such as $a in (1000...filesize-1000)
e. Add additional strings that relate to the malware.
f. Use the PE module to check that the number of Authenticode signatures is 0.

3. How can you make this rule better?

Select the condition that would best improve this rule.

rule MAL_CobaltStrike_StartW {

strings:

$a = "StartW" 

$b1 = "beacon.dll"  fullword        

$b2 = "beacon.x86.dll" fullword        

$b3 = "beacon.x64.dll" fullword

$z = "rule MAL_CobaltStrike"

condition:

any of them

}


a. filesize < 5MB and $a and not $z
b. filesize < 100MB and #a=1 and all of them
c. filesize < 5MB and $a in (1..10) and any of them and not $z
d. filesize < 5MB and $a and 1 of ($b*) and not $z