Skip to content

Instantly share code, notes, and snippets.

@Samirbous

Samirbous/uptime c2 scripts

Created July 5, 2023 14:22
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save Samirbous/16c7530b67ed9d82a12376eba2518806 to your computer and use it in GitHub Desktop.
Save Samirbous/16c7530b67ed9d82a12376eba2518806 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
uptime c2 scripts
sequence by process.entity_id
[process where event.action == "start" and
process.pe.original_file_name : ("cscript.exe", "wscript.exe", "AutoIt*.exe", "python*.exe") ]
[network where process.uptime >= 300 and
event.action == "connection_attempted" and network.direction == "egress" and network.transport == "tcp" and source.port >= 49152 and not destination.address : ("127.*", "::1")]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment