nuclei-templates/network/jarm/c2/sliver-c2-jarm.yaml

id: sliver-c2-jarm

info:
  name: Sliver C2 JARM - Detect
  author: pussycat0x
  severity: info
  description: |
    Sliver is an open source cross-platform adversary emulation/red team framework, it can be used by organizations of all sizes to perform security testing. Sliver's implants support C2 over Mutual TLS (mTLS), WireGuard, HTTP(S), and DNS and are dynamically compiled with per-binary asymmetric encryption keys.
  reference:
    - https://github.com/cedowens/C2-JARM
    - https://github.com/BishopFox/sliver
  metadata:
    max-request: 1
  tags: jarm,network,c2,ir,osint,cti,sliver
tcp:
  - inputs:
      - data: 2E
        type: hex
    host:
      - "{{Hostname}}"
    matchers:
      - type: dsl
        dsl:
          - "jarm(Hostname) == '2ad2ad0002ad2ad00041d2ad2ad41da5207249a18099be84ef3c8811adc883'"
# digest: 490a00463044022018dacd852adfda29bc10fc93a53311d69334d582250e9a34c4a3a08c217d38b3022036811e74ad505a275a2536fc499738fe00d36634dac662162c4a70d604c9e632:922c64590222798bb761d5b6d8e72950
C2 Jarm - Detect 2023-07-14 08:02:24 +00:00			`id: sliver-c2-jarm`

			`info:`
			`name: Sliver C2 JARM - Detect`
			`author: pussycat0x`
			`severity: info`
			`description: \|`
			`Sliver is an open source cross-platform adversary emulation/red team framework, it can be used by organizations of all sizes to perform security testing. Sliver's implants support C2 over Mutual TLS (mTLS), WireGuard, HTTP(S), and DNS and are dynamically compiled with per-binary asymmetric encryption keys.`
			`reference:`
			`- https://github.com/cedowens/C2-JARM`
			`- https://github.com/BishopFox/sliver`
TemplateMan Update [Tue Jul 18 08:23:15 UTC 2023] :robot: 2023-07-18 08:23:15 +00:00			`metadata:`
			`max-request: 1`
Revert "TemplateMan Update [Mon Apr 8 11:30:07 UTC 2024] :robot:" This reverts commit 433dda4ae5b824564b44075bb95a96ecdbe263a6. 2024-04-08 11:34:33 +00:00			`tags: jarm,network,c2,ir,osint,cti,sliver`
C2 Jarm - Detect 2023-07-14 08:02:24 +00:00			`tcp:`
			`- inputs:`
			`- data: 2E`
			`type: hex`
			`host:`
			`- "{{Hostname}}"`
			`matchers:`
			`- type: dsl`
			`dsl:`
templateman update 2023-10-14 11:27:55 +00:00			`- "jarm(Hostname) == '2ad2ad0002ad2ad00041d2ad2ad41da5207249a18099be84ef3c8811adc883'"`
Auto Template Signing [Fri Jan 26 08:31:11 UTC 2024] :robot: 2024-01-26 08:31:11 +00:00			`# digest: 490a00463044022018dacd852adfda29bc10fc93a53311d69334d582250e9a34c4a3a08c217d38b3022036811e74ad505a275a2536fc499738fe00d36634dac662162c4a70d604c9e632:922c64590222798bb761d5b6d8e72950`