2023-06-14 14:17:12 +00:00
id : orcus-rat-c2
info :
name : OrcusRAT - Detect
author : pussycat0x
severity : info
description : |
Orcus RAT is a type of malicious software program that enables remote access and control of computers and networks. It is a type of Remote Access Trojan (RAT) that has been used by attackers to gain access to and control computers and networks.
reference : |
https://github.com/thehappydinoa/awesome-censys-queries#orcusrat--
metadata :
2023-06-21 21:03:53 +00:00
verified : "true"
2023-10-14 11:27:55 +00:00
max-request : 1
censys-query: 'services.tls.certificates.leaf_data.subject.common_name : {"Orcus Server" , "OrcusServerCertificate" }'
2023-12-07 21:57:41 +00:00
tags : c2,ir,osint,malware,ssl,orcusrat
2023-06-14 14:17:12 +00:00
ssl :
- address : "{{Host}}:{{Port}}"
matchers :
- type : word
part : issuer_cn
words :
- "Orcus Server"
- "OrcusServerCertificate"
condition : or
extractors :
- type : json
json :
- ".issuer_cn"
2023-12-08 07:58:29 +00:00
# digest: 4b0a00483046022100949341b5b8eba40e2aec42e145d0d996d907ddab80b6a90225f1ab7bd430fa18022100b52df8a836805768f9fcdc627a8f9d0f16f2684735e0d9fbf0d0426759b18bc3:922c64590222798bb761d5b6d8e72950
