SHA-1 and SHA-256 about red_team_tool_countermeasures

[williballenthin]

We will not be publishing SHA1 or SHA256 hashes at this time.

The MD5 hashes referenced in the rules are primarily for correlating with FEYE internal builds of the red team tools. They are not intended to be used for detection. We believe that hash-based detections are exceedingly trivial to bypass (this is not meant to spawn a debate on the merits of detection strategies) and we don't claim that an attacker can or will use these same compiled binaries. In fact, they probably won't - many of the referenced hashes correspond to binaries built specifically to support the recent detection efforts.

[ruppde]

Can you please add SHA-1 and SHA-256 Checksum?

you will find some sha1 and sha2 in here:
https://docs.google.com/spreadsheets/d/1uRAT-khTdp7fp15XwkiDXo8bD0FzbdkevJ2CeyXeORs/edit#gid=696675697
via https://twitter.com/cyb3rops/status/1336583694912516096

[ruppde]

@williballenthin

We believe that hash-based detections are exceedingly trivial to bypass (this is not meant to spawn a debate on the merits of detection strategies) and we don't claim that an attacker can or will use these same compiled binaries. In fact, they probably won't - many of the referenced hashes correspond to binaries built specifically to support the recent detection efforts.

you have 61 rules which rely only on the typelibguid, aren't those bypassed as easily? change the typelibguid, recompile, bingo?