CelesTLSH attack tool hashes¶
Lookup tlsh malware
TLSH digests of public attack tools and C2 frameworks, keyed on TLSH_Hash. Use with tlsh(dict="celes_tlsh"), then match() on tlsh_match to bring in Repo_Name and File_Name.
From: Magonia Research
Part of: CelesTLSH fuzzy hash hunting
Required by: Untrusted Binary Similar to an Attack Tool, TLSH Similarity to Attack Tools
Add it¶
In Bifract, open Exchange, find CelesTLSH attack tool hashes and click Add. Adds a lookup filled from the URL below, refreshed on its schedule. Needs a tenant admin.
Settings¶
| Setting | Value |
|---|---|
| Lookup name | celes_tlsh |
| Kind | value |
| URL | https://raw.githubusercontent.com/Magonia-Research/CelesTLSH-Hashes/refs/heads/main/all_attack_tools_hashes.csv |
| Key column | TLSH Hash |
| Other columns | Repo Name, File Name, Release Version |
| Refresh every | 1 day |