DcRat Server C2 - Detect

patch-1
pussycat0x 2023-06-14 19:50:16 +05:30 committed by GitHub
parent 1e0744f23b
commit a927b5976a
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 28 additions and 0 deletions

28
ssl/c2/dcrat-server.yaml Normal file
View File

@ -0,0 +1,28 @@
id: dcrat-server
info:
name: DcRat Server C2 - Detect
author: pussycat0x
severity: info
description: |
DCRat uses a modular framework that deploys separate executables for each module, most of which are compiled . net binaries programmed in C#.
reference: |
https://github.com/thehappydinoa/awesome-censys-queries#dcrat--
metadata:
verified: "true"
censys-query: 'services.tls.certificates.leaf_data.subject.common_name: "DcRat Server"'
tags: c2,ir,osint,dcrat,ssl
ssl:
- address: "{{Host}}:{{Port}}"
matchers:
- type: word
part: issuer_cn
words:
- "DcRat Server"
extractors:
- type: json
json:
- ".issuer_cn"