hiddenillusion/needles.md

Created May 2, 2018 11:51

Star (1) You must be signed in to star a gist
Fork (0) You must be signed in to fork a gist

Select an option

Learn more about clone URLs
Clone this repository at <script src="https://gist.github.com/hiddenillusion/f261ffb8ed5c8273d56ffc1d35745977.js"></script>
Save hiddenillusion/f261ffb8ed5c8273d56ffc1d35745977 to your computer and use it in GitHub Desktop.

Download ZIP

Raw

Web logs

User-Agent is rare
User-Agent is new
Domain is rare
Domain is new
High frequency of http connections
URI is same
URI varies but length is constant
Domain varies but length is constant
Missing referrer
Missing or same referrer to multiple uri’s on single dest.

Refs

https://findingbad.blogspot.com/2018/03/c2-hunting.html

Frameworks & Refs

https://github.com/Cyb3rWard0g/ThreatHunter-Playbook

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment