Havoc C2 - Detection

network/jarm/c2/havoc-c2-jarm.yaml

@@ -0,0 +1,29 @@
+id: havoc-c2-jarm
+
+info:
+  name: Havoc C2 Jarm - Detect
+  author: pussycat0x
+  severity: info
+  description: |
+    Havoc is a modern and malleable post-exploitation command and control framework,
+  reference: |
+    - https://github.com/HavocFramework/Havoc
+    - https://github.com/montysecurity/C2-Tracker
+  metadata:
+    shodan-query: 'ssl:postalCode=3540 ssl.jarm:3fd21b20d00000021c43d21b21b43de0a012c76cf078b8d06f4620c2286f5e'
+    max-request: 1
+    verified: "true"
+  tags: c2,ir,osint,havoc,network
+
+tcp:
+  - inputs:
+      - data: 2E
+        type: hex
+
+    host:
+      - "{{Hostname}}"
+
+    matchers:
+      - type: dsl
+        dsl:
+          - "jarm(Hostname) == '3fd21b20d00000021c43d21b21b43de0a012c76cf078b8d06f4620c2286f5e'"

ssl/c2/havoc-c2.yaml

@@ -0,0 +1,30 @@
+id: havoc-c2
+
+info:
+  name: Havoc C2 - Detect
+  author: pussycat0x
+  severity: info
+  description: |
+    Havoc is a modern and malleable post-exploitation command and control framework,
+  reference: |
+    - https://github.com/HavocFramework/Havoc
+    - https://github.com/montysecurity/C2-Tracker
+  metadata:
+    shodan-query: 'ssl:postalCode=3540 ssl.jarm:3fd21b20d00000021c43d21b21b43de0a012c76cf078b8d06f4620c2286f5e'
+    max-request: 1
+    verified: "true"
+  tags: c2,ir,osint,havoc,ssl
+
+ssl:
+  - address: "{{Host}}:{{Port}}"
+
+    matchers:
+      - type: word
+        part: subject_dn
+        words:
+          - "postalCode=3540"
+
+    extractors:
+      - type: json
+        json:
+          - ".issuer_dn"