From b89feec1b5c4874c2ff5e695e13e60b7ba9deeaf Mon Sep 17 00:00:00 2001 From: Ritik Chaddha <44563978+ritikchaddha@users.noreply.github.com> Date: Fri, 7 Jul 2023 16:27:34 +0530 Subject: [PATCH] updated matcher --- http/exposed-panels/c2/hookbot-rat.yaml | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/http/exposed-panels/c2/hookbot-rat.yaml b/http/exposed-panels/c2/hookbot-rat.yaml index f7bfcca049..03b147df2c 100644 --- a/http/exposed-panels/c2/hookbot-rat.yaml +++ b/http/exposed-panels/c2/hookbot-rat.yaml @@ -7,9 +7,9 @@ info: description: | Hookbot panel were detected. metadata: + verified: true shodan-query: title:"hookbot" - verified: "true" - tags: tech,rat,hookbot,c2,panel + tags: tech,rat,hookbot,c2,panel,detect http: - method: GET @@ -19,5 +19,4 @@ http: matchers: - type: dsl dsl: - - "status_code == 200 && contains(body, 'HOOKBOT')" - condition: and \ No newline at end of file + - "status_code == 200 && contains(body, 'HOOKBOT PANEL')"