c2

C2 The C2 repository seeks to provide a practical implementation of the ideas contained in the Red Team Infrastructure Wike at https://github.com/bluscreenofjeff/Red-Team-Infrastructure-Wiki. In particular, this repository provides two Go packages one for beaconers and another for downloaders. In...

Dashboards-Splunk-DNS-Hunting-Beaconing

DNS Hunting-Beaconing v19.2.0.0 DNS Dashboard for hunting and identifying beaconing This dashboard no longer uses any third-party modules or a Splunk lookup table to identify "Trusted Domains". All of that work has been moved to the Corelight/Zeek sensor. However, the dashboard does use two Splun...

rita

RITA Real Intelligence Threat Analytics If you get value out of RITA and would like to go a step further with hunting automation, futuristic visualizations, and data enrichment, then take a look at AC-Hunter. Brought to you by Active Countermeasures. Sponsored by BHIS. RITA is an open source...

beacon-hunter

Beacon Hunter Detecting Non-Periodic Structured C2 via Additive Recurrence Beacon Hunter detects command-and-control beaconing that uses phi-compatible additive recurrence scheduling — a growing, non-periodic timing pattern where each inter-connection interval approximately equals the sum of the...

MAL-2026-17873 Malicious code in @newspage/libx-amount (npm)

npm user 'priyashareek' published this package in a dependency confusion campaign against the internal scopes @accenturecodefoundry and @newspage. The publisher used 99.99.x versions to outrank the internal packages. 0.0.0-stage and 99.99.1 are empty placeholders. In versions 99.99.4 and 99.99.41...

rita

RITA Inteligencia de Amenazas en Tiempo Real Si RITA te resulta útil y deseas ir un paso más allá con automatización de caza, visualizaciones futuristas y enriquecimiento de datos, echa un vistazo a AC-Hunter. Presentado por Active Countermeasures. Patrocinado por BHIS. RITA es un marco de trabaj...

Malicious code in with-cte (npm)

[email protected] contains no functional code: its only behaviour is a preinstall script that runs node index.js on npm install. index.js collects the install directory, the user's home directory, hostname, username and DNS servers, and the full contents of /etc/passwd and /etc/hosts, then sends the...

Malicious code in css-anchor-pos-fallback (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd0a6c8e1448ffd9abb3732872ea3d49280a422d49524aaa57d0b89a73812f05 The package advertises itself as a CSS anchor-position polyfill but on require executes an IIFE in thunderboltRegistry.js that runs id, whoami, uname...

MAL-2026-17476 Malicious code in css-anchor-pos-fallback (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd0a6c8e1448ffd9abb3732872ea3d49280a422d49524aaa57d0b89a73812f05 The package advertises itself as a CSS anchor-position polyfill but on require executes an IIFE in thunderboltRegistry.js that runs id, whoami, uname...

RITA-J

RITA Real Intelligence Threat Analytics في Jupyter Notebook RITA هو إطار عمل مفتوح المصدر لتحليل حركة مرور الشبكة برعاية Active Countermeasures RITA-J هو تنفيذ ميزات RITA في Jupyter Notebook. الهدف هو دعم جميع أنواع سجلات جدار الحماية/الوكيل/DNS الموجودة بصيغة CSV أو TSV أو JSON، وتسهيل التحليل...

RCE-CVE-2017-0199-detection-analysis

🛡️ BankPaymAdviceVend.Report.docx CVE-2017-0199 – Full Blue Team Sandbox Analysis- My approach to analayze that malware that leadsto critical security vulnerability in Microsoft Office. Advanced Malware Detonation • Exploit Behaviour • IOCs • Detection Engineering. 🎯 1. Executive Summary This...

Malicious code in chat-adapter-matrix (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5710eb2e1a2f6b7a4aca8d943953989e80e056cc77c2071027c2a78744b5ea3a [email protected] executes server.js from every npm lifecycle hook preinstall, install, postinstall, prepare, prepublish, preprepare,...

When Agents Look like Beacons: NIDS Evasion by Model Context Protocol Traffic

The Model Context Protocol MCP standardizes communication between autonomous Artificial Intelligence AI agents and remote tools over Streamable HTTP. This shift introduces a class of machine-generated, authenticated, and high-frequency JSON-RPC traffic directly into enterprise networks. Enterpris...

Malicious code in tailwindcss-contact-forms (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cc68c81374c5b78e36fea2f599c5e0004ead6e56dfd02b40cec4f73c62193b30 The package presents itself as a Tailwind CSS forms plugin README, repository field, and installation docs are copied verbatim from @tailwindcss/form...

Malicious code in AzureCdnInfo.edrtester (VSCode)

The Visual Studio Code Marketplace extension AzureCdnInfo.edrtester version 1.0.4 presents as an EDR/telemetry test utility but is a beaconing backdoor. On activation, extension.js loads edrdrill.js, which performs host reconnaissance — hostname, current working directory and local IP — and...

MAL-2026-16010 Malicious code in AzureCdnInfo.edrtester (VSCode)

The Visual Studio Code Marketplace extension AzureCdnInfo.edrtester version 1.0.4 presents as an EDR/telemetry test utility but is a beaconing backdoor. On activation, extension.js loads edrdrill.js, which performs host reconnaissance — hostname, current working directory and local IP — and...

Malicious code in calcboxlite (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 227fe04d85516bd5348dea2c0c25078d057eacb4f439fd6a241ea0409b7afd09 setup.py and calcboxlite/init.py both invoke a top-level report function that reads getpass.getuser and socket.gethostname and POSTs them as JSON to ...

MAL-2026-14370 Malicious code in @usaa-grp-personal-profile/personal-profile-common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de7570e75b52c8d98aef5a71ab1b1183991359e7e3e1864befba58a9f5ca630a Package published to public npm under an internal-looking scope @usaa-grp-personal-profile at version 999.0.0, a shape consistent with...

MAL-2026-14294 Malicious code in mc-registry (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 50f3053643e65c63fa7d8e3d5c48ae3d659650bd0052137099cd8674232780bc Package publishes as mc-registry with description 'Theta chain registry', but its README, badges, homepage layout, and package listing copy the...

MAL-2026-14247 Malicious code in magika-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 41cd28e41bc842fd046a2bff254f450edd0b6d2d15d961fe768cf5e9ebfa197f magika-js is a typosquat of Google's magika library. The postinstall lifecycle script collects installer host identifiers hostname, platform, arch,...