id: empire-c2

info:
  name: Empire C2 - Detect
  author: pussycat0x
  severity: info
  description: |
    Empire is a post-exploitation and adversary emulation framework that is used to aid Red Teams and Penetration Testers. The Empire server is written in Python 3 and is modular to allow operator flexibility. Empire comes built-in with a client that can be used remotely to access the server. There is also a GUI available for remotely accessing the Empire server.
  reference: |
    - https://github.com/thehappydinoa/awesome-censys-queries#security-applications
    - https://bc-security.gitbook.io/empire-wiki/
  metadata:
    verified: "true"
    max-request: 1
    censys-query: bc517bf173440dad15b99a051389fadc366d5df2 || dcb32e6256459d3660fdc90e4c79e95a921841cc
  tags: c2,ir,osint,empire,panel

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    matchers:
      - type: dsl
        dsl:
          - "(\"dcb32e6256459d3660fdc90e4c79e95a921841cc\" == sha1(body))"
# digest: 490a0046304402201a1d7f9bd754bfcbbde409b840b3d0023dd605dc9cbc024bb3547962292c27a8022020f479adda1f99002ce29c4dcb5f5e37402f0befe1f0f0c6f9c9ff42416b43a3:922c64590222798bb761d5b6d8e72950