diff --git a/ssl/c2/onimai-rat-c2.yaml b/ssl/c2/onimai-rat-c2.yaml index 157720cef2..2d46065fe8 100644 --- a/ssl/c2/onimai-rat-c2.yaml +++ b/ssl/c2/onimai-rat-c2.yaml @@ -7,19 +7,20 @@ info: description: | Onimai is a relatively new closed-source Remote Administration Trojan (RAT) based on Quasar. metadata: - verified: "true" + verified: true max-request: 1 shodan-query: ssl.cert.subject.cn:"Onimai Academies CA" censys-query: 'services.tls.certificates.leaf_data.subject.common_name: {"Onimai Academies CA"}' tags: c2,ir,osint,malware,onimai,rat + ssl: - address: "{{Host}}:{{Port}}" + matchers: - type: word part: issuer_cn words: - "Onimai Academies CA" - condition: or extractors: - type: json