From 58433aec2f4be8d773dc1f084c87e19cb346c5a1 Mon Sep 17 00:00:00 2001
From: Matthew Kienow <matthew_kienow@rapid7.com>
Date: Wed, 26 Jan 2022 17:57:15 -0500
Subject: [PATCH 1/2] Add CALDERA C2 fingerprints

---
 identifiers/service_product.txt | 1 +
 identifiers/vendor.txt          | 1 +
 xml/favicons.xml                | 7 +++++++
 xml/html_title.xml              | 7 +++++++
 4 files changed, 16 insertions(+)

diff --git a/identifiers/service_product.txt b/identifiers/service_product.txt
index d3918330..76a2bc07 100644
--- a/identifiers/service_product.txt
+++ b/identifiers/service_product.txt
@@ -50,6 +50,7 @@ BlackJumboDog
 BladeSystems
 Boa
 Bugzilla
+CALDERA
 CCProxy
 CMS
 CMS400.NET
diff --git a/identifiers/vendor.txt b/identifiers/vendor.txt
index 0793063c..6fec94f4 100644
--- a/identifiers/vendor.txt
+++ b/identifiers/vendor.txt
@@ -410,6 +410,7 @@ Lucent
 Lynx Technology
 Lyris
 MBP Kommunikationssysteme GmbH
+MITRE
 MPI Technologies
 MPS Software
 MRV Communications
diff --git a/xml/favicons.xml b/xml/favicons.xml
index 973bd54f..6f80f77c 100644
--- a/xml/favicons.xml
+++ b/xml/favicons.xml
@@ -1954,4 +1954,11 @@
     <param pos="0" name="service.product" value="Covenant"/>
   </fingerprint>
 
+  <fingerprint pattern="^5508e5abca6493613e11c72f4296ebf4$">
+    <description>MITRE CALDERA C2 framework</description>
+    <example>5508e5abca6493613e11c72f4296ebf4</example>
+    <param pos="0" name="service.vendor" value="MITRE"/>
+    <param pos="0" name="service.product" value="CALDERA"/>
+  </fingerprint>
+
 </fingerprints>
\ No newline at end of file
diff --git a/xml/html_title.xml b/xml/html_title.xml
index 66d31f0e..719c5d44 100644
--- a/xml/html_title.xml
+++ b/xml/html_title.xml
@@ -3730,4 +3730,11 @@
     <param pos="0" name="service.product" value="Covenant"/>
   </fingerprint>
 
+  <fingerprint pattern="^Login | CALDERA$">
+    <description>MITRE CALDERA C2 framework</description>
+    <example>Login | CALDERA</example>
+    <param pos="0" name="service.vendor" value="MITRE"/>
+    <param pos="0" name="service.product" value="CALDERA"/>
+  </fingerprint>
+
 </fingerprints>
\ No newline at end of file

From faf27ee09eba9eb463150142edf63ebf7d9766ee Mon Sep 17 00:00:00 2001
From: Matthew Kienow <matthew_kienow@rapid7.com>
Date: Thu, 27 Jan 2022 00:28:47 -0500
Subject: [PATCH 2/2] Update CPE for caldera

---
 xml/favicons.xml   | 1 +
 xml/html_title.xml | 1 +
 2 files changed, 2 insertions(+)

diff --git a/xml/favicons.xml b/xml/favicons.xml
index 6f80f77c..7eb4c10a 100644
--- a/xml/favicons.xml
+++ b/xml/favicons.xml
@@ -1959,6 +1959,7 @@
     <example>5508e5abca6493613e11c72f4296ebf4</example>
     <param pos="0" name="service.vendor" value="MITRE"/>
     <param pos="0" name="service.product" value="CALDERA"/>
+    <param pos="0" name="service.cpe23" value="cpe:/a:mitre:caldera:-"/>
   </fingerprint>
 
 </fingerprints>
\ No newline at end of file
diff --git a/xml/html_title.xml b/xml/html_title.xml
index 719c5d44..0f1432cb 100644
--- a/xml/html_title.xml
+++ b/xml/html_title.xml
@@ -3735,6 +3735,7 @@
     <example>Login | CALDERA</example>
     <param pos="0" name="service.vendor" value="MITRE"/>
     <param pos="0" name="service.product" value="CALDERA"/>
+    <param pos="0" name="service.cpe23" value="cpe:/a:mitre:caldera:-"/>
   </fingerprint>
 
 </fingerprints>
\ No newline at end of file