DcRat Server C2 - Detect
parent
1e0744f23b
commit
a927b5976a
|
@ -0,0 +1,28 @@
|
|||
id: dcrat-server
|
||||
|
||||
info:
|
||||
name: DcRat Server C2 - Detect
|
||||
author: pussycat0x
|
||||
severity: info
|
||||
description: |
|
||||
DCRat uses a modular framework that deploys separate executables for each module, most of which are compiled . net binaries programmed in C#.
|
||||
reference: |
|
||||
https://github.com/thehappydinoa/awesome-censys-queries#dcrat--
|
||||
metadata:
|
||||
verified: "true"
|
||||
censys-query: 'services.tls.certificates.leaf_data.subject.common_name: "DcRat Server"'
|
||||
tags: c2,ir,osint,dcrat,ssl
|
||||
|
||||
ssl:
|
||||
- address: "{{Host}}:{{Port}}"
|
||||
|
||||
matchers:
|
||||
- type: word
|
||||
part: issuer_cn
|
||||
words:
|
||||
- "DcRat Server"
|
||||
|
||||
extractors:
|
||||
- type: json
|
||||
json:
|
||||
- ".issuer_cn"
|
Loading…
Reference in New Issue