HackTool - CobaltStrike BOF Injection Pattern (09706624-b7f6-455d-9d02-adee024cee1d)

Detects a typical pattern of a CobaltStrike BOF which inject into other processes

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
Disable or Modify Tools - T1685 (bbde9781-60aa-4b8a-a911-895b0c1b3872)	Attack Pattern	HackTool - CobaltStrike BOF Injection Pattern (09706624-b7f6-455d-9d02-adee024cee1d)	Sigma-Rules	1
Native API - T1106 (391d824f-0ef1-47a0-b0ee-c59a75e27670)	Attack Pattern	HackTool - CobaltStrike BOF Injection Pattern (09706624-b7f6-455d-9d02-adee024cee1d)	Sigma-Rules	1