DcRat Server C2 - Detect

ssl/c2/dcrat-server.yaml

@@ -0,0 +1,28 @@
+id: dcrat-server
+
+info:
+  name: DcRat Server C2 - Detect
+  author: pussycat0x
+  severity: info
+  description: |
+    DCRat uses a modular framework that deploys separate executables for each module, most of which are compiled . net binaries programmed in C#.
+  reference: |
+    https://github.com/thehappydinoa/awesome-censys-queries#dcrat--
+  metadata:
+    verified: "true"
+    censys-query: 'services.tls.certificates.leaf_data.subject.common_name: "DcRat Server"'
+  tags: c2,ir,osint,dcrat,ssl
+
+ssl:
+  - address: "{{Host}}:{{Port}}"
+
+    matchers:
+      - type: word
+        part: issuer_cn
+        words:
+          - "DcRat Server"
+
+    extractors:
+      - type: json
+        json:
+          - ".issuer_cn"