id: mac-c2-jarm

info:
  name: MacC2 JARM - Detect
  author: pussycat0x
  severity: info
  description: |
    MacC2 is a macOS post exploitation tool written in python that uses Objective C calls or python libraries as opposed to command line executions. The client is written in python2, which though deprecated is still being shipped with base Big Sur installs. It is possible down the road that Apple will remove python2 (or python altogether) from base macOS installs but as of Nov 2020 this is not the case. Apple plans to eventually remove scripting runtimes from base macOS installs, but it is unknown when that will happen since Big Sur includes python.
  reference:
    - https://github.com/cedowens/C2-JARM
    - https://github.com/cedowens/MacC2
  metadata:
    max-request: 1
  tags: c2,ir,osint,macc2,jarm
tcp:
  - inputs:
      - data: 2E
        type: hex
    host:
      - "{{Hostname}}"
    matchers:
      - type: dsl
        dsl:
          - "jarm(Hostname) == '2ad2ad0002ad2ad22c42d42d000000faabb8fd156aa8b4d8a37853e1063261'"
          - "jarm(Hostname) == '2ad2ad0002ad2ad00042d42d000000ad9bf51cc3f5a1e29eecb81d0c7b06eb'"
        condition: or

# digest: 490a0046304402202f8d3da2b55588ff2c219c6d906360390d2a298c9f90d4b7092137088fd4c87b0220567cf955d0804cb50afae97decd5d78eb3e116a67e8792e9c07362403d33e7e2:922c64590222798bb761d5b6d8e72950