diff --git a/ssl/c2/quasar-rat-c2.yaml b/ssl/c2/quasar-rat-c2.yaml index be1e836a1e..2bfbb82a05 100644 --- a/ssl/c2/quasar-rat-c2.yaml +++ b/ssl/c2/quasar-rat-c2.yaml @@ -1,7 +1,7 @@ id: quasar-rat-c2 info: - name: Detect SSL Certificate Quasar RAT C2 + name: Quasar RAT C2 SSL Certificate - Detect author: johnk3r,pussycat0x severity: info description: | @@ -24,7 +24,7 @@ ssl: words: - "Quasar Server CA" - "OrcusServerCertificate" - condition: or + condition: or extractors: - type: json