nuclei-templates/network/jarm/c2/mac-c2-jarm.yaml

id: mac-c2-jarm

info:
  name: MacC2 JARM - Detect
  author: pussycat0x
  severity: info
  description: |
    MacC2 is a macOS post exploitation tool written in python that uses Objective C calls or python libraries as opposed to command line executions. The client is written in python2, which though deprecated is still being shipped with base Big Sur installs. It is possible down the road that Apple will remove python2 (or python altogether) from base macOS installs but as of Nov 2020 this is not the case. Apple plans to eventually remove scripting runtimes from base macOS installs, but it is unknown when that will happen since Big Sur includes python.
  reference:
    - https://github.com/cedowens/C2-JARM
    - https://github.com/cedowens/MacC2
  metadata:
    max-request: 1
  tags: jarm,network,c2,ir,osint,cti,macc2,tcp
tcp:
  - inputs:
      - data: 2E
        type: hex
    host:
      - "{{Hostname}}"
    matchers:
      - type: dsl
        dsl:
          - "jarm(Hostname) == '2ad2ad0002ad2ad22c42d42d000000faabb8fd156aa8b4d8a37853e1063261'"
          - "jarm(Hostname) == '2ad2ad0002ad2ad00042d42d000000ad9bf51cc3f5a1e29eecb81d0c7b06eb'"
        condition: or
# digest: 4a0a0047304502204167931a67232b3bab7b81bf4798e37df9623a480c40882077ae27ab6459358e022100fa99ad5a42fda7b422434c0b7ed471f9c2ba01536b97b8870a7d7e53310fc9aa:922c64590222798bb761d5b6d8e72950
C2 Jarm - Detect 2023-07-14 08:02:24 +00:00			`id: mac-c2-jarm`

			`info:`
			`name: MacC2 JARM - Detect`
			`author: pussycat0x`
			`severity: info`
			`description: \|`
			MacC2 is a macOS post exploitation tool written in python that uses Objective C calls or python libraries as opposed to command line executions. The client is written in python2, which though deprecated is still being shipped with base Big Sur installs. It is possible down the road that Apple will remove python2 (or python altogether) from base macOS installs but as of Nov 2020 this is not the case. Apple plans to eventually remove scripting runtimes from base macOS installs, but it is unknown when that will happen since Big Sur includes python.
			`reference:`
			`- https://github.com/cedowens/C2-JARM`
			`- https://github.com/cedowens/MacC2`
TemplateMan Update [Tue Jul 18 08:23:15 UTC 2023] :robot: 2023-07-18 08:23:15 +00:00			`metadata:`
			`max-request: 1`
TemplateMan Update [Fri Jun 7 10:04:28 UTC 2024] :robot: 2024-06-07 10:04:29 +00:00			`tags: jarm,network,c2,ir,osint,cti,macc2,tcp`
C2 Jarm - Detect 2023-07-14 08:02:24 +00:00			`tcp:`
			`- inputs:`
			`- data: 2E`
			`type: hex`
			`host:`
			`- "{{Hostname}}"`
			`matchers:`
			`- type: dsl`
			`dsl:`
			`- "jarm(Hostname) == '2ad2ad0002ad2ad22c42d42d000000faabb8fd156aa8b4d8a37853e1063261'"`
			`- "jarm(Hostname) == '2ad2ad0002ad2ad00042d42d000000ad9bf51cc3f5a1e29eecb81d0c7b06eb'"`
templateman update 2023-10-14 11:27:55 +00:00			`condition: or`
Auto Template Signing [Fri Jan 26 08:31:11 UTC 2024] :robot: 2024-01-26 08:31:11 +00:00			`# digest: 4a0a0047304502204167931a67232b3bab7b81bf4798e37df9623a480c40882077ae27ab6459358e022100fa99ad5a42fda7b422434c0b7ed471f9c2ba01536b97b8870a7d7e53310fc9aa:922c64590222798bb761d5b6d8e72950`