Skip to main content

Recently active topics

17 Topics
L
Lembright_CensysCensys Team
posted in Threat hunting
Analysis Uncovers Hidden Infrastructure of Iranian Fox Kitten Group

 “at the end of the day, it’s not actually computer-to-computer, right?” he said. “The technology is a vector for human beings. Behind the connection is a person." - Nate Fick,  US State’s ambassador for cyber.Using this mentality, and the fact that humans have patterns, I dug into IOCs from the Joint Cybersecurity Advisory on Iranian threat actor group “Fox Kitten” to uncover hosts that shared either identical IOCs or similar patterns (ports, software, certificates, DNS, etc) and therefore, are likely part of their infrastructure that wasn’t mentioned in the report. Check out the analysis here.Specifically, a search for domain IOCs from the Advisory yielded the following IPs with those IOCs in their DNS and certificate records. These IPs were not listed in the Advisory yet share Autonomous Systems/networks with host IOCs that are listed in the Advisory, further linking them to the group.“Host M” - 64.176.165[.]17 “Host N” - 70.34.218[.]77 “Host O” - 70.34.218[.]77What does this mean f

1
MattK_Censys
4 hours ago
M
Matthew Embee ResearchNew Participant
posted in Search findings, use cases, and queries
Hunting Query For Remcos RAT

 Hey allCame across another cool query to share with you. This time for Remcos C2’s, and was based on an initial post from drb_ra on X. same_service(services.banner_hashes="sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" and services.tls.certificates.leaf_data.signature.self_signed=`true` and not services.tls.certificate.parsed.subject_dn:?* and not services.tls.certificate.parsed.issuer_dn:?* and services.tls.ja4s: t130200_1301_234ea6891581) The main part of the query is this empty certificate and JA4s value. As well as an empty service header on the same port. There’s some cool hits for Remcos with 0 VT on the C2. I haven’t been able to check all of the results yet. Although many so far are known C2’s for Remcos.  

1
MattK_Censys
4 hours ago
MattK_Censys
MattK_CensysCensys Community Manager
Censys Release Notes for September 16, 2024

The following enhancements and improvements are now available to Censys ASM and Search customers.Censys ASMAdded support for scanning AWS Transfer Family resources to our AWS Cloud Connector.New ProtocolsAdded support for the following protocols:CMORE_HMI RTSP MDNSNew FingerprintsAdded the following fingerprints: Type Name Description Query software Dignity Health PACS Dignity Health sites for managing and accessing PACS systems through browser-based access. Search Query software PacsGear by Hyland PacsGear by Hyland is a medical imaging software solution for managing and accessing PACS systems through browser-based access. Search Query software PICOM365 This is a cloud PACS service. PICOM365 delivers automated, scalable, secure diagnostic imaging workflow and data exchange. Search Query software Ligolo This is a Ligolo Server. Search Que

160
MattK_Censys
2 days ago
M
Matthew Embee ResearchNew Participant
posted in Search findings, use cases, and queries
Hunting Astaroth Malware Domains With Redirects

Hey All,  Came across a cool query to find the Astaroth domains from this twitter post. https://x.com/johnk3r/status/1833899781099524181The apex domains (ignoring subdomain) all seem to redirect to twitter, linkedin or instagram which is strange. Combined with the unusual .cfd domain, it’s unique enough to make a query.This works best if you have regexservices.http.response.headers: (key: `Location` and value.headers:/https?:\/\/(www\.)?(instagram|x|twitter|linkedin).com/) AND services.tls.certificates.leaf_data.names:"*cfd"For those without regex, you can use this and replace instagram with linkedin, twitter or x. services.http.response.headers: (key: `Location` and value.headers:`https://www.instagram.com`) AND services.tls.certificates.leaf_data.names:"*cfd" 

0
M
6 days ago
M
MrTiTiNew Participant
asked in Threat hunting
Ogre Routing - Hunting for Nodes of Ogre Nodes

Hello! We are trying to map IPs in our address space to OGRE router nodes and TOR nodes. Do you know of any way to investigate this through Censys or do you know of any sources of information related to this?Here are some links on the subject of Ogre Routing, with some similarities to TOR Routing:-https://github.com/NthMetal/ogre-router/blob/master/README.md-https://github.com/NthMetal/ogre-router-server Thanks!

1
MattK_Censys
7 days ago
MattK_Censys
MattK_CensysCensys Community Manager
Censys Release Notes for September 9, 2024

The following enhancements and improvements are now available to Censys ASM and Search customers.Censys ASM Accepted risk events now appear in the Microsoft Sentinel risk table via our integration. This enables you to manage a single list of accepted risks in Microsoft Sentinel, instead of two separate lists.  Rapid ResponseThe Censys Rapid Response team published information about and queries for the following issues and vulnerabilities:Unauthenticated RCE in Veeam Backup & Replication [CVE-2024-40711] To identify all exposed Veeam Backup & Replication servers, the following Censys queries can be used: Censys Search Query: services.software: (vendor: “Veeam” and product: “Backup Server”) and not labels: {tarpit, honeypot, truncated} Censys ASM Query: host.services.software: (vendor: “Veeam” and product: “Backup Server”) or web_entity.instances.software: (vendor: “Veeam” and product: “Backup Server”) Mirai Botnet Variant Targeting Unpatchable AVTECH CCTV Camera Command In

170
MattK_Censys
9 days ago
J
Joao SoaresNew Participant
asked in ASM Q&A
Find assets that were discovered through certificates

Has anyone found a way to filter, using queries or API, for assets that were found through Certificates?The only point I see in common is the source as “Censys Scan” but I need to narrow it down further.

2
J
9 days ago
john
johnNew Participant
posted in Search findings, use cases, and queries
ChatOps for Open Port Monitoring

Ports accidentally being opened to the Internet is an age-old problem. This results in regular firewall reviews or, worse, having the port identified with a discovered vulnerability, raising the risk to the organization. Increasing complexity, continuous deployments, and chances of misconfigurations have increased the need for third-party validation.I built Lunker Zero for ChatOps to perform regular checks with Censys Search to determine when ports are open/closed based on the Autonomous System (AS) number query results.

1
MattK_Censys
12 days ago
MattK_Censys
MattK_CensysCensys Community Manager
posted in Search findings, use cases, and queries
CQOTW for September 5, 2024: Script edition: Monitoring new certs that could be impersonating an organization

Hey all, this week I’ve got a script that you can use with Censys Python to monitor newly-issued certificates that could be impersonating an org. Fill in the org name and date desired for your purposes:from censys.search import CensysCertsimport timeimport jsonDATE = '2023-12-30'start_time = time.time()c = CensysCerts()certs_dict = {}all_certs = []# Single page of search resultsquery = c.search(f'\"organization\" and parsed.extensions.subject_alt_name.dns_names: \"*organization*\" and added_at:[{DATE} to *]', per_page=100, pages=-1)count = 0for page in query: count += 1 print(f"page {count}") # print("--- %s seconds ---" % (time.time() - start_time)) for cert in page: all_certs.append(cert)certs_dict['data'] = all_certswith open("results.json", "w") as outfile: json.dump(certs_dict, outfile)print("--- %s seconds ---" % (time.time() - start_time)) This is part of a regular series of posts in which we highlight useful, interesting, and otherwise cool queries for use

0
MattK_Censys
13 days ago
RachelH_Censys
RachelH_CensysCensys Team
posted in Other security topics
Manufacturing Use Case Queries for Search & ASM

Hi there! Censys recently published a blog about the prevalence of ransomware attacks on manufacturing firms, based on new research from GRF. Within the blog, our team included some manufacturing use case queries you can run in Censys Search and Censys ASM to identify and monitor relevant protocols, like those for building automation, PLC communication, HMI/SCADA, and more. Examples: Building Automation ProtocolsBACnetSearch Query: services.service_name:BACNET ASM Query: host.services.service_name:BACNETHMI/SCADARed Lion CrimsonSearch Query: services.service_name:REDLION_CRIMSON or services.software:(vendor=”Red Lion” and product=”Crimson”) ASM Query: host.services.service_name:REDLION_CRIMSON or host.services.software:(vendor=”Red Lion” and product=”Crimson”) You can check out the full article here: https://censys.com/top-targets-the-impact-of-ransomware-on-manufacturing/

0
RachelH_Censys
14 days ago
MattK_Censys
MattK_CensysCensys Community Manager
Censys Release Notes for September 3, 2024

The following enhancements and improvements are now available to Censys ASM and Search customers.Censys SearchQuickly identify vulnerable hosts and exposures using the following enhancements for CVE Context in the Censys Search UI: Filters in search results: Filter by CVE ID, CVSS Scores, and CISA’s KEV catalog in the left navigation panel. CVE count in host record preview: See the total number of CVEs for a host at a glance in the host record preview in search results. CVE tab and page on host records: View the total number of CVEs associated with a host record via the new CVEs tab. Click this tab to see detailed information about all CVEs detected on a host, sorted by CVSS score and KEV catalog status. This added visibility in the Search web interface complements the CVE context that was already available in the raw data and via API. The CVE Context dataset is only available to customers who have purchased the add-on for this data. Contact your Censys account team to learn more a

270
MattK_Censys
15 days ago
MattK_Censys
MattK_CensysCensys Community Manager
posted in Search findings, use cases, and queries
Cool Query of the Week for August 29, 2024: Searching for typosquatted domains

This week I’ve got a hosts query to help you locate potentially typosquatted domains. This one uses regex and looks for DNS names in host records that start with “cens” and then have exactly two characters following that before a variety of TLDs, notably not including .com: dns.names: /cens.{2}\.(xyz|info|top|net|org|biz|name|io)/ This was formatted to return results that may be similar to Censys.If your Censys account doesn’t have access to regex in queries, you can use wildcards or a tool like dnstwist to identify specific domain names that you want to investigate with a targeted search.This is part of a regular series of posts in which we highlight useful, interesting, and otherwise cool queries for use with Censys Search and ASM. If you have any questions, similar queries, or custom versions of this week’s highlight, let us know!

0
MattK_Censys
20 days ago
MattK_Censys
MattK_CensysCensys Community Manager
Censys Release Notes for August 26, 2024

The following enhancements and improvements are now available to Censys ASM and Search customers.Rapid ResponseThe Censys Rapid Response team published information about and queries for the following issues and vulnerabilities:Microsoft Windows IPv6 TCP/IP RCE (CVE-2024-38063) To identify potentially vulnerable non-hosted Windows systems for CVE-2024-38063, you can use the same Censys queries that were shared to track CVE-2024-38077: Censys Search Query: services.parsed.dcerpc.endpoints.explained_uuid=”3d267954-eeb7-11d1-b94e-00c04fa3080d v1.0″ Censys ASM Query: host.services.parsed.dcerpc.endpoints.explained_uuid=”3d267954-eeb7-11d1-b94e-00c04fa3080d v1.0″ Censys ASM Risk Query: risks.name=”Windows Remote Desktop Licensing Service RCE Vulnerability [CVE-2024-38077]” New FingerprintsAdded the following fingerprints: Type Name Description Query software BrainBoxes Ethernet to Serial This is a BrainBoxes Ethernet to Serial Device.

370
MattK_Censys
23 days ago
MattK_Censys
MattK_CensysCensys Community Manager
asked in Search Q&A
Can I specify a historical date for my search?

We often hear this question from search users, and the response is at the moment you cannot.Searches run in the web UI and API are always for hosts and virtual hosts as they are currently known.However, on any host page, you can select Host History to see a chronology of events and go back to a historical view, but searches using history are not supported. 

1
L
26 days ago
MattK_Censys
MattK_CensysCensys Community Manager
posted in ASM use cases and queries
Cool Query of the Week for August 22, 2024 ASM Edition: Hosts with accessible HTTP services that might be accidentally exposed

Hey all! This week’s query is geared toward our ASM users, but could be fairly easily modified to work in Search as well. It uses regex, so just note that if you want to port it to Search fields you will need a Search Pro or above license to use the name value string as-is.host.name: /.*(login|admin|uat|dev|test|staging|legacy).*/ and host.services.http.response.status_code: 200 This one is along the same lines of the query I shared last week to return HTTP sites with an executable file listed in their index fileThis is part of a regular series of posts in which we highlight useful, interesting, and otherwise cool queries for use with Censys Search and ASM. If you have any questions, similar queries, or custom versions of this week’s highlight, let us know!

0
MattK_Censys
27 days ago
MattK_Censys
MattK_CensysCensys Community Manager
asked in ASM Q&A
How to obtain total ASM asset numbers and new ASM assets using the API

This is a question we’ve received from a few customers and I wanted to share the info here for folks to use.Total number of assets (can be broken down by type by adding query=type%3AHOST, for example):curl -X GET "https://app.in.corp.censys.io/api/inventory/v1?workspaces=<INSERT WORKSPACE_ID>&query=%2A&pageSize=100&fields=type" -H "accept: application/json" -H "Censys-Api-Key: <INSERT ASM_API_KEY>"Total number of new assets (can be broken down by asset type as described above, edit the association_date as needed:curl -X GET "https://app.in.corp.censys.io/api/inventory/v1?workspaces=<INSERT WORKSPACE_ID>&query=association_date%3A%20%5Bnow-24h%20TO%20now%5D&pageSize=100&fields=type" -H "accept: application/json" -H "Censys-Api-Key: <INSERT ASM_API_KEY>"

0
MattK_Censys
28 days ago
MattK_Censys
MattK_CensysCensys Community Manager
Censys Release Notes for August 19, 2024

The following enhancements and improvements are now available to Censys ASM and Search customers.Rapid ResponseThe Censys Rapid Response team published information about and queries for the following issues and vulnerabilities:Windows Remote Desktop Licensing Service RCE (CVE-2024-38077) To identify potentially vulnerable non-hosted Windows Remote Desktop Licensing Service instances, the following Censys queries can be used: Censys Search Query: services.parsed.dcerpc.endpoints.explained_uuid=”3d267954-eeb7-11d1-b94e-00c04fa3080d v1.0″ Censys ASM Query: host.services.parsed.dcerpc.endpoints.explained_uuid=”3d267954-eeb7-11d1-b94e-00c04fa3080d v1.0″ Censys ASM Risk Query: risks.name=”Windows Remote Desktop Licensing Service RCE Vulnerability [CVE-2024-38077]” Elastic Kibana Prototype Tainting RCE (CVE-2024-37287) To identify potentially vulnerable Kibana instances, the following Censys queries can be used (note that these queries do not filter by version): Censys Search Query:

390
MattK_Censys
30 days ago

Badge winners

Show all badges
Terms & ConditionsCookie settings