id: generic-c2-jarm

info:
  name: Generic C2 JARM - Detect
  author: pussycat0x
  severity: info
  description: |
    Detect C2 Servers with JARM Hashes
  reference:
    - https://github.com/MichaelKoczwara/C2JARM
  metadata:
    max-request: 1
  tags: network,jarm,c2,ir,osint,cti,tcp
tcp:
  - inputs:
      - data: 2E
        type: hex
    host:
      - "{{Hostname}}"
    matchers:
      - type: dsl
        dsl:
          - "jarm(Hostname) == '00014d16d21d21d00042d41d00041df1e57cd0b3bf64d18696fb4fce056610'"
          - "jarm(Hostname) == '00014d16d21d21d07c42d41d00041d47e4e0ae17960b2a5b4fd6107fbb0926'"
          - "jarm(Hostname) == '05d02d16d04d04d05c05d02d05d04d4606ef7946105f20b303b9a05200e829'"
          - "jarm(Hostname) == '07d00016d21d21d00042d41d00041df1e57cd0b3bf64d18696fb4fce056610'"
          - "jarm(Hostname) == '07d0bd0fd06d06d07c07d0bd07d06d9b2f5869a6985368a9dec764186a9175'"
          - "jarm(Hostname) == '07d0bd0fd21d21d07c07d0bd07d21d9b2f5869a6985368a9dec764186a9175'"
          - "jarm(Hostname) == '07d14d16d21d21d00007d14d07d21d3fe87b802002478c27f1c0da514dbf80'"
          - "jarm(Hostname) == '07d14d16d21d21d00042d41d00041d47e4e0ae17960b2a5b4fd6107fbb0926'"
          - "jarm(Hostname) == '07d14d16d21d21d00042d41d00041de5fb3038104f457d92ba02e9311512c2'"
          - "jarm(Hostname) == '07d14d16d21d21d07c07d14d07d21d4606ef7946105f20b303b9a05200e829'"
          - "jarm(Hostname) == '07d14d16d21d21d07c07d14d07d21d9b2f5869a6985368a9dec764186a9175'"
          - "jarm(Hostname) == '07d14d16d21d21d07c07d14d07d21dee4eea372f163361c2623582546d06f8'"
          - "jarm(Hostname) == '07d14d16d21d21d07c42d41d00041d24a458a375eef0c576d23a7bab9a9fb1'"
          - "jarm(Hostname) == '07d14d16d21d21d07c42d41d00041d58c7162162b6a603d3d90a2b76865b53'"
          - "jarm(Hostname) == '07d14d16d21d21d07c42d43d00041d24a458a375eef0c576d23a7bab9a9fb1'"
          - "jarm(Hostname) == '07d19d1ad21d21d00007d19d07d21d25f4195751c61467fa54caf42f4e2e61'"
          - "jarm(Hostname) == '15d15d15d3fd15d00042d42d00042d1279af56d3d287bbc5d38e226153ba9e'"
          - "jarm(Hostname) == '15d3fd16d21d21d00042d43d000000fe02290512647416dcf0a400ccbc0b6b'"
          - "jarm(Hostname) == '15d3fd16d29d29d00015d3fd15d29d1f9d8d2d24bf6c1a8572e99c89f1f5f0'"
          - "jarm(Hostname) == '15d3fd16d29d29d00042d43d000000ed1cf37c9a169b41886e27ba8fad60b0'"
          - "jarm(Hostname) == '15d3fd16d29d29d00042d43d000000fbc10435df141b3459e26f69e76d5947'"
          - "jarm(Hostname) == '15d3fd16d29d29d00042d43d000000fe02290512647416dcf0a400ccbc0b6b'"
          - "jarm(Hostname) == '16d16d16d00000022c43d43d00043d370cd49656587484eb806b90846875a0'"
          - "jarm(Hostname) == '1dd28d28d00028d00042d41d00041df1e57cd0b3bf64d18696fb4fce056610'"
          - "jarm(Hostname) == '1dd28d28d00028d1dc1dd28d1dd28d3fe87b802002478c27f1c0da514dbf80'"
          - "jarm(Hostname) == '21b10b00021b21b21b21b10b21b21b3b0d229d76f2fd7cb8e23bb87da38a20'"
          - "jarm(Hostname) == '21d10d00021d21d21c21d10d21d21d696c1bb221f80034f540b6754152d3b8'"
          - "jarm(Hostname) == '21d19d00021d21d21c42d43d000000624c0617d7b1f32125cdb5240cd23ec9'"
          - "jarm(Hostname) == '29d29d00029d29d08c29d29d29d29dcd113334714fbefb4b0aba4000bcef62'"
          - "jarm(Hostname) == '29d29d00029d29d21c29d29d29d29dce7a321e4956e8298ba917e9f2c22849'"
          - "jarm(Hostname) == '29d29d15d29d29d21c29d29d29d29d7329fbe92d446436f2394e041278b8b2'"
          - "jarm(Hostname) == '2ad00016d2ad2ad22c42d42d00042ddb04deffa1705e2edc44cae1ed24a4da'"
          - "jarm(Hostname) == '2ad2ad0002ad2ad00042d42d000000301510f56407964db9434a9bb0d4ee4a'"
          - "jarm(Hostname) == '2ad2ad0002ad2ad00042d42d0000005d86ccb1a0567e012264097a0315d7a7'"
          - "jarm(Hostname) == '2ad2ad0002ad2ad22c2ad2ad2ad2ad6a7bd8f51d54bfc07e1cd34e5ca50bb3'"
          - "jarm(Hostname) == '2ad2ad0002ad2ad22c2ad2ad2ad2adce7a321e4956e8298ba917e9f2c22849'"
          - "jarm(Hostname) == '2ad2ad16d2ad2ad00042d42d00042ddb04deffa1705e2edc44cae1ed24a4da'"
          - "jarm(Hostname) == '2ad2ad16d2ad2ad22c42d42d00042d58c7162162b6a603d3d90a2b76865b53'"
          - "jarm(Hostname) == '2ad2ad16d2ad2ad22c42d42d00042de4f6cde49b80ad1e14c340f9e47ccd3a'"
          - "jarm(Hostname) == '3fd3fd15d3fd3fd00042d42d00000061256d32ed7779c14686ad100544dc8d'"
          - "jarm(Hostname) == '3fd3fd15d3fd3fd21c3fd3fd3fd3fdc110bab2c0a19e5d4e587c17ce497b15'"
          - "jarm(Hostname) == '3fd3fd15d3fd3fd21c42d42d0000006f254909a73bf62f6b28507e9fb451b5'"
        condition: or
# digest: 4b0a00483046022100e12b4fb5068ed1568791c5f8baf9e6abc4634a70399e83bf1ce03565ecd268dd022100ac5801c31df3f03ddb9650a00257523c3bcaac4fcd3fc02c363f984c1fd981ff:922c64590222798bb761d5b6d8e72950