Automatically created C2 Feeds | Also posted via @drb_ra

• Feeds ( Source/Raw Data courtesy of Censys - https://censys.io/ )
  Search 2.0 has massively improved detection rates on non-standard ports. Great job Censys Team!

  By default C2s seen active in the last 7 days are added to the main feed files.

  • C2 IPs - Live C2 IP (no frontend or CDN IPs - All bad)
  • C2 Domains - All domain names extracted from implants, including domain fronting values and fake Host headers (High abuse of MS, Apple and Google).
  • C2 Domains Filtered - Excludes several domains abused in domain fronting, along with fake headers for popular sites. Current filter list see: exclusions.rex file
  • C2 Domains with URL - Same as domains and domains filtered but including an extra column with the URI path of the C2
  • C2 Domains with URL and IP - Same as domains and domains filtered but including an extra column with the URI path of the C2 and another with the C2 IP

  Additionally a new 30 day set of feed files was added for any C2 seen live in the last 30 days.

• VPN

  • Nord VPN Exit Nodes

• C2_configs

  • Detailed CobaltStrike Configuration in CSV and JSON including the following fields: FirstSeen,ip,ASN,BeaconType,C2Server,Port,SleepTime,Jitter,Proxy_Behavior,HostHeader,CertificateNames,HttpGet_Metadata,HttpPostUri,HttpPost_Metadata,KillDate,PipeName,UserAgent,Watermark,DNS_Idle,DNS_Sleep IP reflects the true C2 IP not the one provided in the configuration of the beacon.

This work is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License.