Posh C2 - Detect

ssl/c2/posh-c2.yaml

@@ -0,0 +1,29 @@
+id: posh-c2
+
+info:
+  name: Posh C2 - Detect
+  author: pussycat0x
+  severity: info
+  description: |
+    PoshC2 is a proxy aware C2 framework used to aid penetration testers with red teaming, post-exploitation and lateral movement.
+  reference: |
+    - https://twitter.com/MichalKoczwara/status/1551639708949692416
+    - https://poshc2.readthedocs.io/en/latest/
+  metadata:
+    verified: "true"
+    shodan-query: ssl:"P18055077"
+  tags: c2,ir,osint,posh,ssl
+
+ssl:
+  - address: "{{Host}}:{{Port}}"
+
+    matchers:
+      - type: word
+        part: issuer_cn
+        words:
+          - "P18055077"
+
+    extractors:
+      - type: json
+        json:
+          - ".issuer_cn"