18 matches found
NetLlix
NetLlix A project created with an aim to emulate and test exfiltration of data over different network protocols. The emulation is performed w/o the usage of native API's. This will help blue teams write correlation rules to detect any type of C2 communication or data exfiltration. Currently, this...
beacon-hunter
Beacon Hunter Detecting Non-Periodic Structured C2 via Additive Recurrence Beacon Hunter detects command-and-control beaconing that uses phi-compatible additive recurrence scheduling — a growing, non-periodic timing pattern where each inter-connection interval approximately equals the sum of the...
BerrySentinel
🫐 Berry Sentinel Real-time behavioral C2 Command & Control connection detector Zero-signature · Bulletproof Collection · Deep Scan · Kill Engine What is it? Berry Sentinel monitors all active network connections on your system and analyzes the behavior of the processes that generate them to detec...
zeek-caldera-detector
zeek-caldera-detector zeek-caldera-detector is a Zeek-based package for detecting Caldera beacons and agent downloads. It is designed to identify suspicious activities associated with Caldera C2 frameworks, including Sandcat, Ragdoll, and Manx. This package provides robust mechanisms for monitori...
zeek-strrat-detector
A Zeek Based STRRAT Malware Detector This is a Zeek Spicy based STRRAT malware detector. PCAP https://app.any.run/tasks/4423258f-59bc-4a88-bfec-d8ac08c88538/ Example Output % zeek -Cr strrat-4423258f-59bc-4a88-bfec-d8ac08c88538.pcap zeek-strrat-detector % cat notice.log separator \x09 setseparato...
zeek-netsupport-detector
NetSupport Background https://unit42.paloaltonetworks.com/cortex-xdr-detects-netsupport-manager-rat-campaign/ Testing PCAP: https://app.any.run/tasks/b5d9853f-0dca-45ef-9532-83feeedcbf42 Example: $ zeek -Cr b5d9853f-0dca-45ef-9532-83feeedcbf42.pcap $ cat notice.log separator \x09 setseparator ,...
Fenrir
Fenrir Simple Bash IOC Scanner Fenrir is a simple IOC scanner bash script. It allows scanning Linux/Unix/OSX systems for the following Indicators of Compromise IOCs: Hashes MD5, SHA1 and SHA256 using md5sum, sha1sum, sha -a 256 File Names string - checked for substring of the full path, e.g...
zeek-asyncrat-detector
A Zeek Based AsyncRAT Malware Detector Malware often hides communications with its command and control C2 server over HTTPS. The encryption in HTTPS usually conceals the compromise long enough for the malware to accomplish its goal. This makes detecting malware that uses HTTPS challenging, but on...
Exchange_IOC_Hunter
ExchangeIOCHunter Description: Hunt for IOCs in IIS Logs - CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065 Artefacts Supported: C2 IP Addresses used for scanning and exploitation File Names observed in exploitation attempts Remote Code Execution RCE Usage: powershell...
zeek-quasarrat-detector
A Zeek Based QuasarRAT Malware Detector Malware often hides communications with its command and control C2 server over HTTPS. The encryption in HTTPS usually conceals the compromise long enough for the malware to accomplish its goal. This makes detecting malware that uses HTTPS challenging, but...
bothan
bothan Confirm an ip:port is hosting Empire. Eventual support for other C2s. Usage Direct single query ❯❯ bothan -v localhost:8080 DEBU2020-01-19T20:25:02-05:00 Requesting... host="localhost:8080" INFO2020-01-19T20:25:02-05:00 SUCCESS host="http://localhost:8080" tool=empire Take a pre-existing...
pingback
Pingback C2 Detection A Zeek package and Suricata rules for detection of ICMP ping tunnels created by the Pingback C2 tool. Accompanying blog post: https://corelight.blog/2021/05/07/pingback-icmp-tunneling-malware/ Installation The easiest way to install this package is through zkg: zkg install...
jarm
JARM 자세한 내용은 초기 JARM 블로그 게시물을 참조하십시오. JARM은 능동적인 TLS전송 계층 보안 서버 지문 분석 도구입니다. JARM 지문은 다음 용도로 사용할 수 있습니다: 그룹 내 모든 서버가 동일한 TLS 구성을 가지고 있는지 빠르게 확인합니다. 인터넷의 다양한 서버를 구성별로 그룹화하여, 예를 들어 해당 서버가 Google, Salesforce 또는 Apple에 속하는지 식별합니다. 기본 애플리케이션이나 인프라를 식별합니다. 악성코드 명령 및 제어C2 인프라와 인터넷상의 기타 악성 서버를 식별합니다. JAR...
RITA-J
Jupyter Notebook における RITA Real Intelligence Threat Analytics RITA は、Active Countermeasures が後援するネットワークトラフィック分析のためのオープンソースフレームワークです。 RITA-J は、Jupyter Notebook で RITA の機能を実装したものです。目標は、CSV、TSV、または JSON 形式のあらゆるタイプのファイアウォール/プロキシ/DNS ログをサポートし、追加のハードウェアや維持管理用の他のコンポーネントをインストールすることなく、潜在的な C2...
zeek-agenttesla-detector
AgentTesla This is a Zeek based AgentTesla malware detector. Testing PCAPs: https://app.any.run/tasks/f9421792-7d2c-47d3-90e0-07eb54ae12fa/ https://app.any.run/tasks/db9f075c-7879-4957-923a-f79fac957a2d/ https://app.any.run/tasks/a30789ce-1e1c-4f96-a097-78c34b9fb612/...
c2finder
c2finder Mandatory disclaimer: I am not a master coder by any means, so this is a very simple script. Do not rely on this to be perfect. I am open to feedback or ideas for improvements, though : Description This script downloads the master C&C list from Bambanek Consulting...
zeek-spicy-facefish
FacefishRootkit This Zeek+Spicy analyzer will detect the Facefish Linux rootkit C2 as described in: https://blog.netlab.360.com/sshstealerfacefishen/ https://blogs.juniper.net/en-us/threat-research/linux-servers-hijacked-to-implant-ssh-backdoor...