corelight/c2-detection-manjusakaManjusaka C2 프레임워크 탐지
C2 프레임워크 Manjusaka 탐지: "Sliver 및 Cobalt Strike의 중국식 형제"
탐지 로직 상세 정보: https://corelight.com/blog/detecting-manjusaka-c2-framework Talos의 분석 보고서: https://blog.talosintelligence.com/2022/08/manjusaka-offensive-framework.html
Suricata 규칙은 여기에서 제공됩니다. https://github.com/corelight/C2-detection-manjusaka/blob/main/suricata-manjusaka-C2.rules
#path="*http*" method=GET user_agent="Mozilla/*" request_body_len=2 status_code=200 response_body_len=5
#path="*http*" request_body_len>0 response_body_len>0 uri=*.png NOT resp_mime_types
#path="*http*" request_body_len>0 response_body_len>0 uri=*.png response_body_len<8
#path="*http*" method=GET
( user_agent="Mozilla/5.0 (Windows NT 8.0; WOW64; rv:58.0) Gecko/20120102 Firefox/58.0" OR user_agent="Mozilla/5.0 (Windows NT 8.0; WOW64; rv:40.0) Gecko")
#path="*http*" method=GET request_body_len>0 uri="/global/favicon.png"
sourcetype="*http*" method=GET user_agent="Mozilla/*" request_body_len=2 status_code=200 response_body_len=5
sourcetype="*http*" request_body_len>0 response_body_len>0 uri=*.png NOT resp_mime_types
sourcetype="*http*" request_body_len>0 response_body_len>0 uri=*.png response_body_len<8
sourcetype="*http*" method=GET
( user_agent="Mozilla/5.0 (Windows NT 8.0; WOW64; rv:58.0) Gecko/20120102 Firefox/58.0" OR user_agent="Mozilla/5.0 (Windows NT 8.0; WOW64; rv:40.0) Gecko")
sourcetype="*http*" method=GET request_body_len>0 uri="/global/favicon.png"