27 lines
1.3 KiB
YAML
27 lines
1.3 KiB
YAML
id: mac-c2-jarm
|
|
|
|
info:
|
|
name: MacC2 JARM - Detect
|
|
author: pussycat0x
|
|
severity: info
|
|
description: |
|
|
MacC2 is a macOS post exploitation tool written in python that uses Objective C calls or python libraries as opposed to command line executions. The client is written in python2, which though deprecated is still being shipped with base Big Sur installs. It is possible down the road that Apple will remove python2 (or python altogether) from base macOS installs but as of Nov 2020 this is not the case. Apple plans to eventually remove scripting runtimes from base macOS installs, but it is unknown when that will happen since Big Sur includes python.
|
|
reference:
|
|
- https://github.com/cedowens/C2-JARM
|
|
- https://github.com/cedowens/MacC2
|
|
metadata:
|
|
max-request: 1
|
|
tags: jarm,c2,ir,osint,cti,macc2
|
|
tcp:
|
|
- inputs:
|
|
- data: 2E
|
|
type: hex
|
|
host:
|
|
- "{{Hostname}}"
|
|
matchers:
|
|
- type: dsl
|
|
dsl:
|
|
- "jarm(Hostname) == '2ad2ad0002ad2ad22c42d42d000000faabb8fd156aa8b4d8a37853e1063261'"
|
|
- "jarm(Hostname) == '2ad2ad0002ad2ad00042d42d000000ad9bf51cc3f5a1e29eecb81d0c7b06eb'"
|
|
condition: or
|
|
# digest: 4a0a004730450220381f5f5623d84444ca23b374414674dabb9f6c6820387f6069e3485c3f865803022100bc6ad34e77be800e177a0dd7c116aab97045239d2c1b1c75f78a0f941466c933:922c64590222798bb761d5b6d8e72950 |