beacon-hunter

Beacon Hunter Detecting Non-Periodic Structured C2 via Additive Recurrence Beacon Hunter detects command-and-control beaconing that uses phi-compatible additive recurrence scheduling — a growing, non-periodic timing pattern where each inter-connection interval approximately equals the sum of the...

Fenrir

Fenrir Simple Bash IOC Scanner Fenrir is a simple IOC scanner bash script. It allows scanning Linux/Unix/OSX systems for the following Indicators of Compromise IOCs: Hashes MD5, SHA1 and SHA256 using md5sum, sha1sum, sha -a 256 File Names string - checked for substring of the full path, e.g...

BerrySentinel

🫐 Berry Sentinel Real-time behavioral C2 Command & Control connection detector Zero-signature · Bulletproof Collection · Deep Scan · Kill Engine What is it? Berry Sentinel monitors all active network connections on your system and analyzes the behavior of the processes that generate them to detec...

pingback

Pingback C2 Detection A Zeek package and Suricata rules for detection of ICMP ping tunnels created by the Pingback C2 tool. Accompanying blog post: https://corelight.blog/2021/05/07/pingback-icmp-tunneling-malware/ Installation The easiest way to install this package is through zkg: zkg install...

zeek-caldera-detector

zeek-caldera-detector zeek-caldera-detector is a Zeek-based package for detecting Caldera beacons and agent downloads. It is designed to identify suspicious activities associated with Caldera C2 frameworks, including Sandcat, Ragdoll, and Manx. This package provides robust mechanisms for monitori...

zeek-asyncrat-detector

A Zeek Based AsyncRAT Malware Detector Malware often hides communications with its command and control C2 server over HTTPS. The encryption in HTTPS usually conceals the compromise long enough for the malware to accomplish its goal. This makes detecting malware that uses HTTPS challenging, but on...

zeek-strrat-detector

A Zeek Based STRRAT Malware Detector This is a Zeek Spicy based STRRAT malware detector. PCAP https://app.any.run/tasks/4423258f-59bc-4a88-bfec-d8ac08c88538/ Example Output % zeek -Cr strrat-4423258f-59bc-4a88-bfec-d8ac08c88538.pcap zeek-strrat-detector % cat notice.log separator \x09 setseparato...

bothan

bothan Confirm an ip:port is hosting Empire. Eventual support for other C2s. Usage Direct single query ❯❯ bothan -v localhost:8080 DEBU2020-01-19T20:25:02-05:00 Requesting... host="localhost:8080" INFO2020-01-19T20:25:02-05:00 SUCCESS host="http://localhost:8080" tool=empire Take a pre-existing...

NetLlix

NetLlix A project created with an aim to emulate and test exfiltration of data over different network protocols. The emulation is performed w/o the usage of native API's. This will help blue teams write correlation rules to detect any type of C2 communication or data exfiltration. Currently, this...

zeek-quasarrat-detector

A Zeek Based QuasarRAT Malware Detector Malware often hides communications with its command and control C2 server over HTTPS. The encryption in HTTPS usually conceals the compromise long enough for the malware to accomplish its goal. This makes detecting malware that uses HTTPS challenging, but...

Exchange_IOC_Hunter

ExchangeIOCHunter Description: Hunt for IOCs in IIS Logs - CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065 Artefacts Supported: C2 IP Addresses used for scanning and exploitation File Names observed in exploitation attempts Remote Code Execution RCE Usage: powershell...

zeek-netsupport-detector

NetSupport Background https://unit42.paloaltonetworks.com/cortex-xdr-detects-netsupport-manager-rat-campaign/ Testing PCAP: https://app.any.run/tasks/b5d9853f-0dca-45ef-9532-83feeedcbf42 Example: $ zeek -Cr b5d9853f-0dca-45ef-9532-83feeedcbf42.pcap $ cat notice.log separator \x09 setseparator ,...

redxor

Linux Malware C2 'RedXOR' - an example detection This package serves as a demonstration of how Zeek can be used to detect the Linux backdoor "redXOR" using state based methods. References: Corelight blog...

zeek-agenttesla-detector

AgentTesla This is a Zeek based AgentTesla malware detector. Testing PCAPs: https://app.any.run/tasks/f9421792-7d2c-47d3-90e0-07eb54ae12fa/ https://app.any.run/tasks/db9f075c-7879-4957-923a-f79fac957a2d/ https://app.any.run/tasks/a30789ce-1e1c-4f96-a097-78c34b9fb612/...

zeek-spicy-facefish

FacefishRootkit This Zeek+Spicy analyzer will detect the Facefish Linux rootkit C2 as described in: https://blog.netlab.360.com/sshstealerfacefishen/ https://blogs.juniper.net/en-us/threat-research/linux-servers-hijacked-to-implant-ssh-backdoor...

c2finder

c2finder Mandatory disclaimer: I am not a master coder by any means, so this is a very simple script. Do not rely on this to be perfect. I am open to feedback or ideas for improvements, though : Description This script downloads the master C&C list from Bambanek Consulting...

jarm

JARM Por favor, lee la publicación inicial del blog sobre JARM para más información. JARM es una herramienta activa de huellas digitales de servidores de seguridad de la capa de transporte TLS. Las huellas digitales de JARM se pueden usar para: Verificar rápidamente que todos los servidores de un...

RITA-J

RITA Real Intelligence Threat Analytics في Jupyter Notebook RITA هو إطار عمل مفتوح المصدر لتحليل حركة مرور الشبكة برعاية Active Countermeasures RITA-J هو تنفيذ ميزات RITA في Jupyter Notebook. الهدف هو دعم جميع أنواع سجلات جدار الحماية/الوكيل/DNS الموجودة بصيغة CSV أو TSV أو JSON، وتسهيل التحليل...

Multi-View Fusion for Encrypted C2 Detection: A Leakage-Controlled Measurement Study of Evaluation Pitfalls

Command-and-control C2 traffic increasingly hides within TLS, so defenders now apply machine learning to traffic metadata. Many studies assume that combining two metadata views, namely flow statistics and TLS handshake fingerprints, improves both accuracy and robustness. We tested this assumption...