nuclei-templates/ssl/c2/cobalt-strike-c2.yaml

29 lines
863 B
YAML

id: cobalt-strike-c2
info:
name: Cobalt Strike C2 - Detect
author: pussycat0x
severity: info
description: |
Cobalt Strike gives you a post-exploitation agent and covert channels to emulate a quiet long-term embedded actor in your customer's network.
reference:
- https://blog.sekoia.io/hunting-and-detecting-cobalt-strike/
metadata:
verified: "true"
max-request: 1
shodan-query: ssl.cert.serial:146473198
tags: ssl,c2,ir,osint,panel
ssl:
- address: "{{Host}}:{{Port}}"
matchers:
- type: dsl
dsl:
- 'contains(serial,"08:BB:00:EE")'
extractors:
- type: json
json:
- ".serial"
# digest: 4a0a00473045022100adb54aef096001b6032dbdfcefad883bf978b99b1f555c4492567adac23750e80220725e108609888ea4f16fb689a7be037e01ff1fcf352e30bc8b17734aaf0e7b5c:922c64590222798bb761d5b6d8e72950