25 lines
1.0 KiB
YAML
25 lines
1.0 KiB
YAML
id: deimos-c2-jarm
|
|
|
|
info:
|
|
name: Deimos C2 JARM - Detect
|
|
author: pussycat0x
|
|
severity: info
|
|
description: |
|
|
DeimosC2 is a post-exploitation Command & Control (C2) tool that leverages multiple communication methods in order to control machines that have been compromised. DeimosC2 server and agents works on, and has been tested on, Windows, Darwin, and Linux.It is entirely written in Golang with a front end written in Vue.js.
|
|
reference:
|
|
- https://github.com/cedowens/C2-JARM
|
|
- https://twitter.com/MichalKoczwara/status/1551632627387473920
|
|
metadata:
|
|
max-request: 1
|
|
tags: jarm,c2,ir,osint,cti,deimos,network
|
|
tcp:
|
|
- inputs:
|
|
- data: 2E
|
|
type: hex
|
|
host:
|
|
- "{{Hostname}}"
|
|
matchers:
|
|
- type: dsl
|
|
dsl:
|
|
- "jarm(Hostname) == '00000000000000000041d00000041d9535d5979f591ae8e547c5e5743e5b64'"
|
|
# digest: 4a0a0047304502200bd84d3fd5377698c83e5b60978762a73bf9079b3b7d243513e3a1a7611351ce0221008bb66136e0d6bbb58b2c2ade1b8fac7107953c73ed310811b3015375bd7be9d2:922c64590222798bb761d5b6d8e72950 |