-
InfluxDB
Power Real-Time Data Analytics at Scale. Get real-time insights from all types of time series data with InfluxDB. Ingest, query, and analyze billions of data points in real-time with unbounded cardinality.
title: Detect Mythic Agent Traffic Over Port 8443 status: experimental author: Rotten_Sec description: Detects traffic over port 8443 that matches the WebSocket handshake used by Mythic agents to communicate with the C2 server. references: - https://github.com/its-a-feature/Mythic tags: - attack.t1071.001 - attack.t1071.004 - attack.t1071.005 - attack.t1071.006 logsource: category: network keywords: [tcp, port, 8443] condition: tcp.port == 8443 and ( "GET /websocket HTTP/1.1\r\n" in to_string($data) or "HTTP/1.1 101 Switching Protocols\r\nUpgrade: websocket\r\nConnection: Upgrade\r\n" in to_string($data) )