<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# Detecting Ransomware Affiliate Tools — API Reference

## YARA Scanning

```bash
# Scan for Cobalt Strike beacon
yara -r cobalt_strike.yar /path/to/scan

# Scan process memory
yara -p 4 affiliate_tools.yar /proc/*/maps 2>/dev/null

# Scan with metadata
yara -r -m -s ransomware_tools.yar /evidence/
```

## Named Pipe Monitoring (Sysmon)

| Pipe Pattern | Tool | Confidence |
|-------------|------|------------|
| `\\MSSE-*` | Cobalt Strike | High |
| `\\postex_*` | Cobalt Strike | High |
| `\\msagent_*` | Cobalt Strike | Medium |
| `\\badger_*` | Brute Ratel | High |

## JA3 Fingerprints

| JA3 Hash | Tool | Notes |
|----------|------|-------|
| `72a589da586844d7f0818ce684948eea` | Cobalt Strike | Default config |
| `a0e9f5d64349fb13191bc781f81f42e1` | Cobalt Strike | Malleable C2 |
| Various | Sliver | Depends on config |

## Network Detection

```bash
# Check Zeek logs for C2 JA3
grep "72a589da586844d7f0818ce684948eea" /var/log/zeek/ssl.log

# DNS beaconing detection
cat dns.log | zeek-cut query | sort | uniq -c | sort -rn | head -20

# Detect high-entropy DNS (DGA)
cat dns.log | zeek-cut query | awk '{print length, $0}' | sort -rn | head -20
```

## Key Parameters

| Parameter | Description | Example |
|-----------|-------------|---------|
| `scan_path` | Directory to scan | `/tmp` |
| `log_path` | Network log directory | `/var/log/zeek` |
| `ja3_hash` | JA3 fingerprint to search | `72a589da...` |
| `yara_rules` | YARA rule file path | `./rules/affiliate.yar` |
