nuclei-templates/http/exposed-panels/c2/deimos-c2.yaml

id: deimos-c2

info:
  name: Deimos C2 - Detect
  author: pussycat0x
  severity: info
  description: |
    DeimosC2 is a post-exploitation Command & Control (C2) tool that leverages multiple communication methods in order to control machines that have been compromised. DeimosC2 server and agents works on, and has been tested on, Windows, Darwin, and Linux.It is entirely written in Golang with a front end written in Vue.js.
  reference: |
    https://twitter.com/MichalKoczwara/status/1551632627387473920
  metadata:
    verified: true
    max-request: 1
    shodan-query: http.html_hash:-14029177
  tags: c2,ir,osint,deimosc2,panel

http:
  - method: GET
    path:
      - '{{BaseURL}}/login'

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '<title>Deimos C2</title>'

      - type: status
        status:
          - 200
# digest: 4a0a00473045022100a05b1817e04d0643682a561d9e55f4f1ef13604b4d1036366e8d897c3a9bbc9002205b7ab5fbf8790f6c876cd2d7e4712e9ef45d92abf8f072b6018a455b075affb3:922c64590222798bb761d5b6d8e72950
C2 - Detection 2023-02-22 15:07:49 +00:00			`id: deimos-c2`

			`info:`
fix-c2 2023-02-23 17:20:06 +00:00			`name: Deimos C2 - Detect`
C2 - Detection 2023-02-22 15:07:49 +00:00			`author: pussycat0x`
			`severity: info`
			`description: \|`
Update deimos-c2.yaml 2023-02-23 17:22:47 +00:00			`DeimosC2 is a post-exploitation Command & Control (C2) tool that leverages multiple communication methods in order to control machines that have been compromised. DeimosC2 server and agents works on, and has been tested on, Windows, Darwin, and Linux.It is entirely written in Golang with a front end written in Vue.js.`
C2 - Detection 2023-02-22 15:07:49 +00:00			`reference: \|`
			`https://twitter.com/MichalKoczwara/status/1551632627387473920`
			`metadata:`
TemplateMan Update [Fri Jun 7 10:04:28 UTC 2024] :robot: 2024-06-07 10:04:29 +00:00			`verified: true`
templateman update 2023-10-14 11:27:55 +00:00			`max-request: 1`
C2 - Detection 2023-02-22 15:07:49 +00:00			`shodan-query: http.html_hash:-14029177`
add exposed-panel tag to templates in http/exposed-panels 2023-06-02 23:19:52 +00:00			`tags: c2,ir,osint,deimosc2,panel`
C2 - Detection 2023-02-22 15:07:49 +00:00
Refactoring the directory structure based on protocols (#7137) * moving http templates * updated cves.json * moved network CVEs * updated scripts * updated workflows * updated requests to http * replaced network to tcp --------- Co-authored-by: sandeep <8293321+ehsandeep@users.noreply.github.com> 2023-04-27 04:28:59 +00:00			`http:`
C2 - Detection 2023-02-22 15:07:49 +00:00			`- method: GET`
			`path:`
			`- '{{BaseURL}}/login'`

			`matchers-condition: and`
			`matchers:`
			`- type: word`
			`part: body`
			`words:`
fix-c2 2023-02-23 17:20:06 +00:00			`- '<title>Deimos C2</title>'`
C2 - Detection 2023-02-22 15:07:49 +00:00
			`- type: status`
			`status:`
fix-c2 2023-02-23 17:20:06 +00:00			`- 200`
Auto Template Signing [Sat Jun 8 16:02:16 UTC 2024] :robot: 2024-06-08 16:02:17 +00:00			`# digest: 4a0a00473045022100a05b1817e04d0643682a561d9e55f4f1ef13604b4d1036366e8d897c3a9bbc9002205b7ab5fbf8790f6c876cd2d7e4712e9ef45d92abf8f072b6018a455b075affb3:922c64590222798bb761d5b6d8e72950`