SPF - How to Write a Construct that Checks for Malicious SSL Certificates
Channel: Mohamad Mokbel
Date: 2017-11-25

In this video I show you how to write an SPF construct based on Eros language for the purpose of checking for malicious certificates (malware C&C) in a given pcap, and in particular, filtering against the Subject Common Name field of the certificate. Additionally, I illustrate how this construct could be automated with SPF for scanning multiple pcaps at the same time.

Moreover, I also talk about limitations that TShark SSL certificate dissector, Windows command shell, and SPF shell impose on us when designing such a construct, and present different ways to overcome them.

List of malicious SSL certificates (Subject Common Name) is taken from abuse.ch SSL Blacklist list available at https://sslbl.abuse.ch/.

"checkcert" construct can be downloaded from http://www.mfmokbel.com/Down/Mix/SPF/CheckCert.zip