27 lines
1.0 KiB
YAML
27 lines
1.0 KiB
YAML
id: empire-c2
|
|
|
|
info:
|
|
name: Empire C2 - Detect
|
|
author: pussycat0x
|
|
severity: info
|
|
description: |
|
|
Empire is a post-exploitation and adversary emulation framework that is used to aid Red Teams and Penetration Testers. The Empire server is written in Python 3 and is modular to allow operator flexibility. Empire comes built-in with a client that can be used remotely to access the server. There is also a GUI available for remotely accessing the Empire server.
|
|
reference: |
|
|
- https://github.com/thehappydinoa/awesome-censys-queries#security-applications
|
|
- https://bc-security.gitbook.io/empire-wiki/
|
|
metadata:
|
|
censys-query: bc517bf173440dad15b99a051389fadc366d5df2 || dcb32e6256459d3660fdc90e4c79e95a921841cc
|
|
max-request: 1
|
|
verified: "true"
|
|
tags: c2,ir,osint,empire
|
|
|
|
http:
|
|
- method: GET
|
|
path:
|
|
- "{{BaseURL}}"
|
|
|
|
matchers:
|
|
- type: dsl
|
|
dsl:
|
|
- "(\"bc517bf173440dad15b99a051389fadc366d5df2\" == sha1(body)) || (\"dcb32e6256459d3660fdc90e4c79e95a921841cc\" == sha1(body))"
|