From a927b5976ad6d988fbdcf68c7e7e766aeb34d420 Mon Sep 17 00:00:00 2001
From: pussycat0x <65701233+pussycat0x@users.noreply.github.com>
Date: Wed, 14 Jun 2023 19:50:16 +0530
Subject: [PATCH 1/2] DcRat Server C2 - Detect

---
 ssl/c2/dcrat-server.yaml | 28 ++++++++++++++++++++++++++++
 1 file changed, 28 insertions(+)
 create mode 100644 ssl/c2/dcrat-server.yaml

diff --git a/ssl/c2/dcrat-server.yaml b/ssl/c2/dcrat-server.yaml
new file mode 100644
index 0000000000..ab72f315a2
--- /dev/null
+++ b/ssl/c2/dcrat-server.yaml
@@ -0,0 +1,28 @@
+id: dcrat-server
+
+info:
+  name: DcRat Server C2 - Detect
+  author: pussycat0x
+  severity: info
+  description: |
+    DCRat uses a modular framework that deploys separate executables for each module, most of which are compiled . net binaries programmed in C#.
+  reference: |
+    https://github.com/thehappydinoa/awesome-censys-queries#dcrat--
+  metadata:
+    verified: "true"
+    censys-query: 'services.tls.certificates.leaf_data.subject.common_name: "DcRat Server"'
+  tags: c2,ir,osint,dcrat,ssl
+
+ssl:
+  - address: "{{Host}}:{{Port}}"
+
+    matchers:
+      - type: word
+        part: issuer_cn
+        words:
+          - "DcRat Server"
+
+    extractors:
+      - type: json
+        json:
+          - ".issuer_cn"

From 8264366f694bc02c8f4818eb343c6abe151554c9 Mon Sep 17 00:00:00 2001
From: Dhiyaneshwaran <leedhiyanesh@gmail.com>
Date: Thu, 15 Jun 2023 14:48:46 +0530
Subject: [PATCH 2/2] Update and rename dcrat-server.yaml to
 dcrat-server-c2.yaml

---
 ssl/c2/{dcrat-server.yaml => dcrat-server-c2.yaml} | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 rename ssl/c2/{dcrat-server.yaml => dcrat-server-c2.yaml} (97%)

diff --git a/ssl/c2/dcrat-server.yaml b/ssl/c2/dcrat-server-c2.yaml
similarity index 97%
rename from ssl/c2/dcrat-server.yaml
rename to ssl/c2/dcrat-server-c2.yaml
index ab72f315a2..2058b9df96 100644
--- a/ssl/c2/dcrat-server.yaml
+++ b/ssl/c2/dcrat-server-c2.yaml
@@ -1,4 +1,4 @@
-id: dcrat-server
+id: dcrat-server-c2
 
 info:
   name: DcRat Server C2 - Detect