GhostFrame ESXi C2 Connection Pattern and IOC Hunt (CEF Firewall Logs)

Goksel Atakan@gokselatakan

•updated today•3•0•13

Detects the GhostFrame ESXi implant's C2 connection pattern in CEF firewall logs: one source reaching one destination on at least five of ports 53, 2222, 3389, 4444, 8443 and 9443 within a minute, plus traffic to or from the three TAG-218 addresses published by Recorded Future. The port filter does not check protocol, so UDP DNS counts toward port 53.