2023-06-14 14:17:12 +00:00
id : orcus-rat-c2
info :
name : OrcusRAT - Detect
author : pussycat0x
severity : info
description : |
Orcus RAT is a type of malicious software program that enables remote access and control of computers and networks. It is a type of Remote Access Trojan (RAT) that has been used by attackers to gain access to and control computers and networks.
reference : |
https://github.com/thehappydinoa/awesome-censys-queries#orcusrat--
metadata :
2023-06-21 21:03:53 +00:00
verified : "true"
2023-10-14 11:27:55 +00:00
max-request : 1
censys-query: 'services.tls.certificates.leaf_data.subject.common_name : {"Orcus Server" , "OrcusServerCertificate" }'
2024-01-14 09:21:50 +00:00
tags : c2,ssl,tls,ir,osint,malware,orcusrat
2023-06-14 14:17:12 +00:00
ssl :
- address : "{{Host}}:{{Port}}"
matchers :
- type : word
part : issuer_cn
words :
- "Orcus Server"
- "OrcusServerCertificate"
condition : or
extractors :
- type : json
json :
- ".issuer_cn"
2024-01-26 08:31:11 +00:00
# digest: 4b0a004830460221009a84552f8b48367ae774ff0611f4956af413a6571aa1f2e6a3d1992dbaadeef6022100c41982b4322eaa7fe523e9cda239ab156620b93663ae067fcae2b42238265b5b:922c64590222798bb761d5b6d8e72950
