Merge pull request #10818 from worldwidefuckfest/patch-1

Create onimai-rat-c2.yaml

ssl/c2/onimai-rat-c2.yaml

@@ -0,0 +1,28 @@
+id: onimai-rat-c2
+
+info:
+  name: Onimai RAT C2 SSL Certificate - Detect
+  author: worldwidefuckfest
+  severity: info
+  description: |
+    Onimai is a relatively new closed-source Remote Administration Trojan (RAT) based on Quasar.
+  metadata:
+    verified: true
+    max-request: 1
+    shodan-query: ssl.cert.subject.cn:"Onimai Academies CA"
+    censys-query: 'services.tls.certificates.leaf_data.subject.common_name: {"Onimai Academies CA"}'
+  tags: c2,ir,osint,malware,onimai,rat
+
+ssl:
+  - address: "{{Host}}:{{Port}}"
+
+    matchers:
+      - type: word
+        part: issuer_cn
+        words:
+          - "Onimai Academies CA"
+
+    extractors:
+      - type: json
+        json:
+          - " .issuer_cn"