v9.5.8 [JARM-based C2 Server Detection Templates]

🔥 Highlight of this release:

This release adds a collection of C2 server detection templates. These templates can be used for automating the identification and classification of various C2 servers based on their JARM fingerprints.

• network/jarm/c2/cobalt-strike-c2-jarm.yaml by @pussycat0x
• network/jarm/c2/covenant-c2-jarm.yaml by @pussycat0x
• network/jarm/c2/deimos-c2-jarm.yaml by @pussycat0x
• network/jarm/c2/evilginx2-jarm.yaml by @pussycat0x
• network/jarm/c2/grat2-c2-jarm.yaml by @pussycat0x
• network/jarm/c2/mac-c2-jarm.yaml by @pussycat0x
• network/jarm/c2/macshell-c2-jarm.yaml by @pussycat0x
• network/jarm/c2/merlin-c2-jarm.yaml by @pussycat0x
• network/jarm/c2/metasploit-c2-jarm.yaml by @pussycat0x
• network/jarm/c2/mythic-c2-jarm.yaml by @pussycat0x
• network/jarm/c2/posh-c2-jarm.yaml by @pussycat0x
• network/jarm/c2/shad0w-c2-jarm.yaml by @pussycat0x
• network/jarm/c2/silenttrinity-c2-jarm.yaml by @pussycat0x
• network/jarm/c2/sliver-c2-jarm.yaml by @pussycat0x

What's Changed

New Templates Added : 113

New CVEs Added: 9

• http/cves/2023/CVE-2023-37270.yaml by @ritikchaddha
• http/cves/2023/CVE-2023-28665.yaml by Aaban SOlutions,@harsh
• http/cves/2023/CVE-2023-23491.yaml by @ritikchaddha
• http/cves/2023/CVE-2023-3460.yaml by @dhiyaneshdk 🔥
• http/cves/2023/CVE-2023-3345.yaml by @dhiyaneshdk
• http/cves/2023/CVE-2023-1546.yaml by Harsh
• http/cves/2023/CVE-2023-0448.yaml by @ritikchaddha
• http/cves/2020/CVE-2020-17463.yaml by @Thirukrishnan
• http/cves/2017/CVE-2017-7925.yaml by @E1A,none
• http/default-logins/yealink/yealink-default-login.yaml by parzival
• http/exposed-panels/anaqua-login-panel.yaml by @Ep1cSage
• http/exposures/tokens/beamer/beamer-token.yaml by @dhiyaneshdk
• http/exposures/tokens/bitbucket/bitbucket-clientid.yaml by @dhiyaneshdk
• http/exposures/tokens/bitbucket/bitbucket-clientsecret.yaml by @dhiyaneshdk
• http/exposures/tokens/bittrex/bittrex-accesskey.yaml by @dhiyaneshdk
• http/exposures/tokens/bittrex/bittrex-secretkey.yaml by @dhiyaneshdk
• http/exposures/tokens/clojars/clojars-token.yaml by @dhiyaneshdk
• http/exposures/tokens/codecov/codecov-accesstoken.yaml by @dhiyaneshdk
• http/exposures/tokens/coinbase/coinbase-accesstoken.yaml by @dhiyaneshdk
• http/exposures/tokens/confluent/confluent-accesstoken.yaml by @dhiyaneshdk
• http/exposures/tokens/confluent/confluent-secretkey.yaml by @dhiyaneshdk
• http/exposures/tokens/contentful/contentful-token.yaml by @dhiyaneshdk
• http/exposures/tokens/databricks/databricks-token.yaml by @dhiyaneshdk
• http/exposures/tokens/datadog/datadog-accesstoken.yaml by @dhiyaneshdk
• http/exposures/tokens/discord/discord-clientid.yaml by @dhiyaneshdk
• http/exposures/tokens/discord/discord-clientsecret.yaml by @dhiyaneshdk
• http/exposures/tokens/discord/discord-token.yaml by @dhiyaneshdk
• http/exposures/tokens/doppler/doppler-token.yaml by @dhiyaneshdk
• http/exposures/tokens/droneci/droneci-accesstoken.yaml by @dhiyaneshdk
• http/exposures/tokens/dropbox/dropbox-long-token.yaml by @dhiyaneshdk
• http/exposures/tokens/dropbox/dropbox-short-token.yaml by @dhiyaneshdk
• http/exposures/tokens/dropbox/dropbox-token.yaml by @dhiyaneshdk
• http/exposures/tokens/duffel/duffel-token.yaml by @dhiyaneshdk
• http/exposures/tokens/easypost/easypost-testtoken.yaml by @dhiyaneshdk
• http/exposures/tokens/easypost/easypost-token.yaml by @dhiyaneshdk
• http/exposures/tokens/etsy/etsy-accesstoken.yaml by @dhiyaneshdk
• http/exposures/tokens/facebook/facebook-token.yaml by @dhiyaneshdk
• http/exposures/tokens/fastly/fastly-token.yaml by @dhiyaneshdk
• http/exposures/tokens/finicity/finicity-clientsecret.yaml by @dhiyaneshdk
• http/exposures/tokens/finicity/finicity-token.yaml by @dhiyaneshdk
• http/exposures/tokens/finnhub/finnhub-accesstoken.yaml by @dhiyaneshdk
• http/exposures/tokens/flickr/flickr-accesstoken.yaml by @dhiyaneshdk
• http/exposures/tokens/flutter/flutterwave-encryptionkey.yaml by @dhiyaneshdk
• http/exposures/tokens/flutter/flutterwave-publickey.yaml by @dhiyaneshdk
• http/exposures/tokens/flutter/flutterwave-secretkey.yaml by @dhiyaneshdk
• http/exposures/tokens/frameio/frameio-token.yaml by @dhiyaneshdk
• http/exposures/tokens/freshbooks/freshbooks-accesstoken.yaml by @dhiyaneshdk
• http/exposures/tokens/gitter/gitter-token.yaml by @dhiyaneshdk
• http/exposures/tokens/gocardless/gocardless-token.yaml by @dhiyaneshdk
• http/exposures/tokens/grafana/grafana-cloud-token.yaml by @dhiyaneshdk
• http/exposures/tokens/grafana/grafana-key.yaml by @dhiyaneshdk
• http/exposures/tokens/grafana/grafana-serviceaccount-token.yaml by @dhiyaneshdk
• http/exposures/tokens/hashicorp/hashicorp-token.yaml by @dhiyaneshdk
• http/exposures/tokens/zendesk/zendesk-key.yaml by @dhiyaneshdk
• network/jarm/c2/cobalt-strike-c2-jarm.yaml by @pussycat0x
• network/jarm/c2/covenant-c2-jarm.yaml by @pussycat0x
• network/jarm/c2/deimos-c2-jarm.yaml by @pussycat0x
• network/jarm/c2/evilginx2-jarm.yaml by @pussycat0x
• network/jarm/c2/grat2-c2-jarm.yaml by @pussycat0x
• network/jarm/c2/mac-c2-jarm.yaml by @pussycat0x
• network/jarm/c2/macshell-c2-jarm.yaml by @pussycat0x
• network/jarm/c2/merlin-c2-jarm.yaml by @pussycat0x
• network/jarm/c2/metasploit-c2-jarm.yaml by @pussycat0x
• network/jarm/c2/mythic-c2-jarm.yaml by @pussycat0x
• network/jarm/c2/posh-c2-jarm.yaml by @pussycat0x
• network/jarm/c2/shad0w-c2-jarm.yaml by @pussycat0x
• network/jarm/c2/silenttrinity-c2-jarm.yaml by @pussycat0x
• network/jarm/c2/sliver-c2-jarm.yaml by @pussycat0x
• http/miscellaneous/spnego-detect.yaml by @lady_bug,ruppde
• http/technologies/graylog/graylog-api-exposure.yaml by Arqsz
• file/keys/beamer-api-token.yaml by @dhiyaneshdk
• file/keys/bitbucket/bitbucket-client-id.yaml by @dhiyaneshdk
• file/keys/bitbucket/bitbucket-client-secret.yaml by @dhiyaneshdk
• file/keys/bittrex/bittrex-access-key.yaml by @dhiyaneshdk
• file/keys/bittrex/bittrex-secret-key.yaml by @dhiyaneshdk
• file/keys/clojars-api-token.yaml by @dhiyaneshdk
• file/keys/codecov-access-token.yaml by @dhiyaneshdk
• file/keys/coinbase-access-token.yaml by @dhiyaneshdk
• file/keys/confluent/confluent-access-token.yaml by @dhiyaneshdk
• file/keys/confluent/confluent-secret-token.yaml by @dhiyaneshdk
• file/keys/contentful-api-token.yaml by @dhiyaneshdk
• file/keys/databricks-api-token.yaml by @dhiyaneshdk
• file/keys/datadog-access-token.yaml by @dhiyaneshdk
• file/keys/discord/discord-api-token.yaml by @dhiyaneshdk
• file/keys/discord/discord-cilent-secret.yaml by @dhiyaneshdk
• file/keys/discord/discord-client-id.yaml by @dhiyaneshdk
• file/keys/doppler-api-token.yaml by @dhiyaneshdk
• file/keys/droneci-access-token.yaml by @dhiyaneshdk
• file/keys/dropbox/dropbox-api-token.yaml by @dhiyaneshdk
• file/keys/dropbox/dropbox-longlived-token.yaml by @dhiyaneshdk
• file/keys/dropbox/dropbox-shortlived-token.yaml by @dhiyaneshdk
• file/keys/duffel-api-token.yaml by @dhiyaneshdk
• file/keys/easypost/easypost-api-token.yaml by @dhiyaneshdk
• file/keys/easypost/easypost-test-token.yaml by @dhiyaneshdk
• file/keys/etsy-access-token.yaml by @dhiyaneshdk
• file/keys/facebook/facebook-api-token.yaml by @dhiyaneshdk
• file/keys/fastly-api-token.yaml by @dhiyaneshdk
• file/keys/finicity/finicity-api-token.yaml by @dhiyaneshdk
• file/keys/finicity/finicity-client-secret.yaml by @dhiyaneshdk
• file/keys/finnhub-access-token.yaml by @dhiyaneshdk
• file/keys/flickr-access-token.yaml by @dhiyaneshdk
• file/keys/flutter/flutterwave-encryption-key.yaml by @dhiyaneshdk
• file/keys/flutter/flutterwave-public-key.yaml by @dhiyaneshdk
• file/keys/flutter/flutterwave-secret-key.yaml by @dhiyaneshdk
• file/keys/frameio-api-token.yaml by @dhiyaneshdk
• file/keys/freshbooks-access-token.yaml by @dhiyaneshdk
• file/keys/gitter-access-token.yaml by @dhiyaneshdk
• file/keys/gocardless-api-token.yaml by @dhiyaneshdk
• file/keys/grafana/grafana-api-key.yaml by @dhiyaneshdk
• file/keys/grafana/grafana-cloud-api-token.yaml by @dhiyaneshdk
• file/keys/grafana/grafana-service-account-token.yaml by @dhiyaneshdk
• file/keys/hashicorp-api-token.yaml by @dhiyaneshdk
• file/keys/zendesk-secret-key.yaml by @dhiyaneshdk

New Contributors

• @MalavikaSK made their first contribution in #6514
• @FreeZeroDays made their first contribution in #7691
• @bob-the-builder-v made their first contribution in #7602
• @Thirukrishnan made their first contribution in #7705
• @TheArqsz made their first contribution in #6963

Full Changelog: v9.5.7...v9.5.8