nuclei-templates/ssl/c2/bitrat-c2.yaml

id: bitrat-c2

info:
  name: Bitrat C2 - Detect
  author: pussycat0x
  severity: info
  description: |
    BitRAT is a fairly recent, notorious remote access trojan (RAT) marketed on underground cybercriminal web markets and forums since Feb 2021. The RAT is particularly well known for its social media presence and functionality such as: Data exfiltration. Execution of payloads with bypasses.
  reference: |
    https://github.com/thehappydinoa/awesome-censys-queries#bitrat--
  metadata:
    verified: "true"
    max-request: 1
    censys-query: 'services.tls.certificates.leaf_data.subject.common_name: "BitRAT"'
  tags: ssl,tls,c2,ir,osint,malware,bitrat
ssl:
  - address: "{{Host}}:{{Port}}"
    matchers:
      - type: word
        part: issuer_cn
        words:
          - "BitRAT"

    extractors:
      - type: json
        json:
          - ".issuer_cn"
# digest: 4a0a0047304502203efa2110b89bf8e00bea7a2e767c43396b19f90f9c502427f2d037e77df75600022100b3b759ed19c25cf118e1cd3b85bb0e679410ee6a3051adffe54271097fac481c:922c64590222798bb761d5b6d8e72950
Bitrat C2 - Detect 2023-06-14 14:21:21 +00:00			`id: bitrat-c2`

			`info:`
			`name: Bitrat C2 - Detect`
			`author: pussycat0x`
			`severity: info`
			`description: \|`
			`BitRAT is a fairly recent, notorious remote access trojan (RAT) marketed on underground cybercriminal web markets and forums since Feb 2021. The RAT is particularly well known for its social media presence and functionality such as: Data exfiltration. Execution of payloads with bypasses.`
			`reference: \|`
			`https://github.com/thehappydinoa/awesome-censys-queries#bitrat--`
			`metadata:`
TemplateMan Update [Wed Jun 21 21:03:53 UTC 2023] :robot: 2023-06-21 21:03:53 +00:00			`verified: "true"`
templateman update 2023-10-14 11:27:55 +00:00			`max-request: 1`
			`censys-query: 'services.tls.certificates.leaf_data.subject.common_name: "BitRAT"'`
auto tagging via templateman 2024-01-14 09:21:50 +00:00			`tags: ssl,tls,c2,ir,osint,malware,bitrat`
Bitrat C2 - Detect 2023-06-14 14:21:21 +00:00			`ssl:`
			`- address: "{{Host}}:{{Port}}"`
			`matchers:`
			`- type: word`
			`part: issuer_cn`
			`words:`
			`- "BitRAT"`

			`extractors:`
			`- type: json`
			`json:`
			`- ".issuer_cn"`
Auto Template Signing [Fri Dec 8 07:58:29 UTC 2023] :robot: 2023-12-08 07:58:29 +00:00			`# digest: 4a0a0047304502203efa2110b89bf8e00bea7a2e767c43396b19f90f9c502427f2d037e77df75600022100b3b759ed19c25cf118e1cd3b85bb0e679410ee6a3051adffe54271097fac481c:922c64590222798bb761d5b6d8e72950`