27 lines
1007 B
YAML
27 lines
1007 B
YAML
id: sliver-c2-jarm
|
|
|
|
info:
|
|
name: Sliver C2 JARM - Detect
|
|
author: pussycat0x
|
|
severity: info
|
|
description: |
|
|
Sliver is an open source cross-platform adversary emulation/red team framework, it can be used by organizations of all sizes to perform security testing. Sliver's implants support C2 over Mutual TLS (mTLS), WireGuard, HTTP(S), and DNS and are dynamically compiled with per-binary asymmetric encryption keys.
|
|
reference:
|
|
- https://github.com/cedowens/C2-JARM
|
|
- https://github.com/BishopFox/sliver
|
|
metadata:
|
|
max-request: 1
|
|
tags: c2,ir,osint,sliver,jarm
|
|
tcp:
|
|
- inputs:
|
|
- data: 2E
|
|
type: hex
|
|
host:
|
|
- "{{Hostname}}"
|
|
matchers:
|
|
- type: dsl
|
|
dsl:
|
|
- "jarm(Hostname) == '2ad2ad0002ad2ad00041d2ad2ad41da5207249a18099be84ef3c8811adc883'"
|
|
|
|
# digest: 4a0a00473045022100d359b3fae3886dcdd5e1c86b1fe07e1b92dc10fc01043cab87f32fae611e7e5602207f1a90fef828d1489c3e7fa6f2aac19bf0e412ba92c7555789158978059526ed:922c64590222798bb761d5b6d8e72950
|