Community Forum

Recently active
Help others
Categories

Analysis Uncovers Hidden Infrastructure of Iranian Fox Kitten Group

“at the end of the day, it’s not actually computer-to-computer, right?” he said. “The technology is a vector for human beings. Behind the connection is a person." - Nate Fick, US State’s ambassador for cyber.Using this mentality, and the fact that humans have patterns, I dug into IOCs from the Joint Cybersecurity Advisory on Iranian threat actor group “Fox Kitten” to uncover hosts that shared either identical IOCs or similar patterns (ports, software, certificates, DNS, etc) and therefore, are likely part of their infrastructure that wasn’t mentioned in the report. Check out the analysis here.Specifically, a search for domain IOCs from the Advisory yielded the following IPs with those IOCs in their DNS and certificate records. These IPs were not listed in the Advisory yet share Autonomous Systems/networks with host IOCs that are listed in the Advisory, further linking them to the group.“Host M” - 64.176.165[.]17 “Host N” - 70.34.218[.]77 “Host O” - 70.34.218[.]77What does this mean f

4 hours ago

Matthew Embee ResearchNew Participant

Search findings, use cases, and queries

Hunting Query For Remcos RAT

Hey allCame across another cool query to share with you. This time for Remcos C2’s, and was based on an initial post from drb_ra on X. same_service(services.banner_hashes="sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" and services.tls.certificates.leaf_data.signature.self_signed=`true` and not services.tls.certificate.parsed.subject_dn:?* and not services.tls.certificate.parsed.issuer_dn:?* and services.tls.ja4s: t130200_1301_234ea6891581) The main part of the query is this empty certificate and JA4s value. As well as an empty service header on the same port. There’s some cool hits for Remcos with 0 VT on the C2. I haven’t been able to check all of the results yet. Although many so far are known C2’s for Remcos.

4 hours ago

MattK_CensysCensys Community Manager

Censys Release Notes for September 16, 2024

The following enhancements and improvements are now available to Censys ASM and Search customers.Censys ASMAdded support for scanning AWS Transfer Family resources to our AWS Cloud Connector.New ProtocolsAdded support for the following protocols:CMORE_HMI RTSP MDNSNew FingerprintsAdded the following fingerprints: Type Name Description Query software Dignity Health PACS Dignity Health sites for managing and accessing PACS systems through browser-based access. Search Query software PacsGear by Hyland PacsGear by Hyland is a medical imaging software solution for managing and accessing PACS systems through browser-based access. Search Query software PICOM365 This is a cloud PACS service. PICOM365 delivers automated, scalable, secure diagnostic imaging workflow and data exchange. Search Query software Ligolo This is a Ligolo Server. Search Que

160

2 days ago

Matthew Embee ResearchNew Participant

Search findings, use cases, and queries

Hunting Astaroth Malware Domains With Redirects

Hey All, Came across a cool query to find the Astaroth domains from this twitter post. https://x.com/johnk3r/status/1833899781099524181The apex domains (ignoring subdomain) all seem to redirect to twitter, linkedin or instagram which is strange. Combined with the unusual .cfd domain, it’s unique enough to make a query.This works best if you have regexservices.http.response.headers: (key: `Location` and value.headers:/https?:\/\/(www\.)?(instagram|x|twitter|linkedin).com/) AND services.tls.certificates.leaf_data.names:"*cfd"For those without regex, you can use this and replace instagram with linkedin, twitter or x. services.http.response.headers: (key: `Location` and value.headers:`https://www.instagram.com`) AND services.tls.certificates.leaf_data.names:"*cfd"

6 days ago

MrTiTiNew Participant

Threat hunting

Ogre Routing - Hunting for Nodes of Ogre Nodes

Hello! We are trying to map IPs in our address space to OGRE router nodes and TOR nodes. Do you know of any way to investigate this through Censys or do you know of any sources of information related to this?Here are some links on the subject of Ogre Routing, with some similarities to TOR Routing:-https://github.com/NthMetal/ogre-router/blob/master/README.md-https://github.com/NthMetal/ogre-router-server Thanks!

7 days ago

MattK_CensysCensys Community Manager

Censys Release Notes for September 9, 2024

The following enhancements and improvements are now available to Censys ASM and Search customers.Censys ASM Accepted risk events now appear in the Microsoft Sentinel risk table via our integration. This enables you to manage a single list of accepted risks in Microsoft Sentinel, instead of two separate lists. Rapid ResponseThe Censys Rapid Response team published information about and queries for the following issues and vulnerabilities:Unauthenticated RCE in Veeam Backup & Replication [CVE-2024-40711] To identify all exposed Veeam Backup & Replication servers, the following Censys queries can be used: Censys Search Query: services.software: (vendor: “Veeam” and product: “Backup Server”) and not labels: {tarpit, honeypot, truncated} Censys ASM Query: host.services.software: (vendor: “Veeam” and product: “Backup Server”) or web_entity.instances.software: (vendor: “Veeam” and product: “Backup Server”) Mirai Botnet Variant Targeting Unpatchable AVTECH CCTV Camera Command In

170

9 days ago

Joao SoaresNew Participant

ASM Q&A

Find assets that were discovered through certificates

Has anyone found a way to filter, using queries or API, for assets that were found through Certificates?The only point I see in common is the source as “Censys Scan” but I need to narrow it down further.

9 days ago

johnNew Participant

Search findings, use cases, and queries

ChatOps for Open Port Monitoring

Ports accidentally being opened to the Internet is an age-old problem. This results in regular firewall reviews or, worse, having the port identified with a discovered vulnerability, raising the risk to the organization. Increasing complexity, continuous deployments, and chances of misconfigurations have increased the need for third-party validation.I built Lunker Zero for ChatOps to perform regular checks with Censys Search to determine when ports are open/closed based on the Autonomous System (AS) number query results.

12 days ago

MattK_CensysCensys Community Manager

Search findings, use cases, and queries

CQOTW for September 5, 2024: Script edition: Monitoring new certs that could be impersonating an organization

Hey all, this week I’ve got a script that you can use with Censys Python to monitor newly-issued certificates that could be impersonating an org. Fill in the org name and date desired for your purposes:from censys.search import CensysCertsimport timeimport jsonDATE = '2023-12-30'start_time = time.time()c = CensysCerts()certs_dict = {}all_certs = []# Single page of search resultsquery = c.search(f'\"organization\" and parsed.extensions.subject_alt_name.dns_names: \"*organization*\" and added_at:[{DATE} to *]', per_page=100, pages=-1)count = 0for page in query: count += 1 print(f"page {count}") # print("--- %s seconds ---" % (time.time() - start_time)) for cert in page: all_certs.append(cert)certs_dict['data'] = all_certswith open("results.json", "w") as outfile: json.dump(certs_dict, outfile)print("--- %s seconds ---" % (time.time() - start_time)) This is part of a regular series of posts in which we highlight useful, interesting, and otherwise cool queries for use

13 days ago

RachelH_CensysCensys Team

Other security topics

Manufacturing Use Case Queries for Search & ASM

Hi there! Censys recently published a blog about the prevalence of ransomware attacks on manufacturing firms, based on new research from GRF. Within the blog, our team included some manufacturing use case queries you can run in Censys Search and Censys ASM to identify and monitor relevant protocols, like those for building automation, PLC communication, HMI/SCADA, and more. Examples: Building Automation ProtocolsBACnetSearch Query: services.service_name:BACNET ASM Query: host.services.service_name:BACNETHMI/SCADARed Lion CrimsonSearch Query: services.service_name:REDLION_CRIMSON or services.software:(vendor=”Red Lion” and product=”Crimson”) ASM Query: host.services.service_name:REDLION_CRIMSON or host.services.software:(vendor=”Red Lion” and product=”Crimson”) You can check out the full article here: https://censys.com/top-targets-the-impact-of-ransomware-on-manufacturing/

14 days ago

MrTiTiNew Participant

Threat hunting

Ogre Routing - Hunting for Nodes of Ogre Nodes

7 days ago

MattK_CensysCensys Community Manager

Search Q&A

Can I specify a historical date for my search?

We often hear this question from search users, and the response is at the moment you cannot.Searches run in the web UI and API are always for hosts and virtual hosts as they are currently known.However, on any host page, you can select Host History to see a chronology of events and go back to a historical view, but searches using history are not supported.

26 days ago

MattK_CensysCensys Community Manager

ASM Q&A

How to obtain total ASM asset numbers and new ASM assets using the API

This is a question we’ve received from a few customers and I wanted to share the info here for folks to use.Total number of assets (can be broken down by type by adding query=type%3AHOST, for example):curl -X GET "https://app.in.corp.censys.io/api/inventory/v1?workspaces=<INSERT WORKSPACE_ID>&query=%2A&pageSize=100&fields=type" -H "accept: application/json" -H "Censys-Api-Key: <INSERT ASM_API_KEY>"Total number of new assets (can be broken down by asset type as described above, edit the association_date as needed:curl -X GET "https://app.in.corp.censys.io/api/inventory/v1?workspaces=<INSERT WORKSPACE_ID>&query=association_date%3A%20%5Bnow-24h%20TO%20now%5D&pageSize=100&fields=type" -H "accept: application/json" -H "Censys-Api-Key: <INSERT ASM_API_KEY>"

28 days ago

jowestNew Participant

Search Q&A

List of towns in a county?

Hi,Is there perhaps a list of towns to check in a specific country, if there is where can I find it.Please let me know.Thanks!

1 month ago

DavidSH_CensysCensys Team

ASM Q&A

Which Qualys APIs are used to Add and Remove IPs from Qualys VMDR?

Censys’s integration with Qualys VMDR Automatically add new hosts to your Qualys VMDR environment for vulnerability scans. With this connection, you can view and add Censys-discovered unknown hosts to Qualys asset groups.Below are sample API calls and links back to the Qualys API docs that are used in the integration. Please note that the calls differ based on Qualys User Permissions:If the user is a Unit Manager, the call to add IP to a subscription must include ag_title (Asset group title) and the actions of “Add IP to subscription” and “Add IP to asset group” will happen in one request. If the user is a Manager, the call to add IP to a subscription does not include ag_title, and the actions of “Add IP to subscription” and “Add IP to asset group” will happen in two requests.For all requests use header Accept: application/xmlUnit Manager:Add IP to subscription and asset group:https://<USERNAME>:<PASSWORD>@qualysapi.qg2.apps.qualys.com/api/2.0/fo/asset/ip/?action=add&ag

1 month ago

ZebazNew Participant

Search Q&A

Searching services within history of large number of hosts

I have a use case where I want to search for historical activity of services on a large number of hosts (200k+)Currently this is my approach (using the API):Search for hosts For each host: get changed events within a time period For each changed event: check if the event potentially matches the service criteria (e.g. port or protocol) For each of these candidate events: get host details at the candidate event timestamp Extract service details from response This works, but is quite involved and consumes a lot of API credits.Did anyone find a better way to query the service history of multiple hosts?Thanks!

1 month ago

Mark ThomassonNew Participant

Search Q&A

Integration of Censys with various Threat Intel Platforms

would like to know who might be in charge of technology partnerships so users can use Censys with their favorite Threat Intel platform sadly Censys is not part of my favorite TIP - Open CTI - https://filigran.notion.site/OpenCTI-Ecosystem-868329e9fb734fca89692b2ed6087e76 just sayin

1 month ago

MattK_CensysCensys Community Manager

Search Q&A

How can I find hosts in a specific country running a specific software?

This is another series of posts I’ll be making that cover basic use-cases and building blocks for Censys Search--this one is called “How can I...” We’ll start out with “How can I find hosts in a specific country running a specific software?“ Here’s an example query that returns hosts in Russia detected running gSOAP: location.country=Russia and services.software.product: gSOAP This query uses the location.country field to set a geographic boundary and the services.software.product field to identify the software in focus. Another potential starting point for this would be to start with simply the location.country=Russia query and then run a report on those results that uses services.software.product as the breakdown field. This will provide you with a window into the types of software products that have been detected on hosts in Russia, allowing you to identify software of interest and perform follow-up queries.

2 months ago

rudraNew Participant

Search Q&A

XSS related question

I have been searching for XSS and other vulnerability on multiple platforms and I have found that most of them filter it. However, in login forms, if I include “<” or “>” [without quotes], the text in between was not shown in the error message. Here is what I typed in the username: Admin <script>alert('xss')</script> HelloHere is what the error message shown: Error: The username Admin Hello is not registered on this site. If you are unsure of your username, try your email address instead.I think that this is due to the input sanitizer, or it might be something else that idk.Has anyone encountered such situation before?

2 months ago

TheGift73New Participant

Threat hunting

EASM Threat Hunting Best Practices

Hi,I was wondering what is the best way to start doing some External Attack Surface threat hunting for a specific organisation using Censys using the free community account type. Are there good way to start doing this whilst reducing any potential false positives, such as looking for a specific version of PHP seen on a server/machine rather than just PHP as a whole?

2 months ago

Welcome

Everything you need to know about the Censys Community

Getting started in the Community

5 topics
0 Replies

Announcements

3 topics
0 Replies

Introductions

6 topics
4 Replies

General security topics

Talk about general security topics, using Censys and other tools to discover and investigate potential threats, and more

Security news

3 topics
3 Replies

Threat hunting

6 topics
7 Replies

Censys Rapid Response

3 topics
0 Replies

Ask the community

Find answers to all your Censys questions here

Search Q&A

8 topics
13 Replies

ASM Q&A

6 topics
2 Replies

Use-cases, queries, and findings

Share your use-cases, queries, and unique findings with Search or ASM

Search findings, use cases, and queries

15 topics
3 Replies

ASM use cases and queries

1 topic
0 Replies

User leaderboard

Badges

JeffG_Censyshas earned the badge Censys Staff
RachelH_Censyshas earned the badge Censys Staff
mfarmer_censyshas earned the badge Censys Staff
Lembright_Censyshas earned the badge Censys Staff
StephanieG_Censyshas earned the badge Censys Staff

Show all badges

Explore the community

Join conversations, learn and grow with people who get community like you

Welcome

Getting started in the Community

Announcements

Introductions

General security topics

Security news

Threat hunting

Censys Rapid Response

Other security topics

Ask the community

Search Q&A

ASM Q&A

Use-cases, queries, and findings

Search findings, use cases, and queries

ASM use cases and queries

User leaderboard

Badges

Community Forum

Explore the community

Join conversations, learn and grow with people who get community like you

User leaderboard

Badges

Sign up

Log in to the Censys Community

Scanning file for viruses.

This file cannot be downloaded