Skip to content

Havoc C2 Jarm - Detect

ID: havoc-c2-jarm

Severity: info

Author: pussycat0x

Tags: jarm,c2,ir,osint,cti,havoc,network,tcp

Havoc is a modern and malleable post-exploitation command and control framework,

id: havoc-c2-jarm
info:
name: Havoc C2 Jarm - Detect
author: pussycat0x
severity: info
description: |
Havoc is a modern and malleable post-exploitation command and control framework,
reference: |
- https://github.com/HavocFramework/Havoc
- https://github.com/montysecurity/C2-Tracker
metadata:
verified: "true"
max-request: 1
shodan-query: 'ssl:postalCode=3540 ssl.jarm:3fd21b20d00000021c43d21b21b43de0a012c76cf078b8d06f4620c2286f5e'
tags: jarm,c2,ir,osint,cti,havoc,network,tcp
tcp:
- inputs:
- data: 2E
type: hex
host:
- "{{Hostname}}"
matchers:
- type: dsl
dsl:
- "jarm(Hostname) == '3fd21b20d00000021c43d21b21b43de0a012c76cf078b8d06f4620c2286f5e'"
# digest: 4b0a00483046022100b24163af0def44217c445ce4a5aebe22b792c849753106d25b1075c14576d7480221009c38db979496e9001b945fd90801683dd46fe28176ef8f624196f55cf7feec16:922c64590222798bb761d5b6d8e72950

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

Terminal window
$ nuclei -u "URL" -t "network/jarm/c2/havoc-c2-jarm.yaml"

View on Github