Appendix F: IOC Catalogue

This catalogue turns the reconstruction into defensive leads. It covers the RCS operator/backend platform and the deployment edge visible in the examined source. It is not a universal signature for HackingTeam products, and it does not claim to identify every implant, customer configuration, successor product, or later version.

An indicator’s value depends on where it is observed. A TLS issuer can be seen on a network sensor. A REST path normally requires TLS termination. A service name requires host telemetry or a forensic image. A MongoDB collection shape requires database access. The tables preserve that sensor position together with provenance and false-positive limits.

Confidence has the following meaning:

• high — a distinctive combination directly supported by original source, installer material, or a matching lab artifact;
• medium — useful in the stated sensor position but plausibly shared by other custom or legacy systems; and
• low — a triage lead that needs independent RCS-specific evidence.

Do not block or attribute solely on a low-confidence item. Even a high- confidence technical match identifies software or infrastructure, not the customer, operator, legal authority, target, or successful use.

Highest-value combinations

These combinations are starting points for confirmation. Preserve surrounding transactions, process state, certificates, database metadata, and timestamps before taking disruptive action.

Network and service topology

The book’s host ports 127.0.0.1:44443 and 127.0.0.1:44444 are lab mappings, not original RCS indicators. Likewise, container names such as rcs-db-lab:9.2, the private Compose network, and port 8080 belong to the reconstruction only.

TLS and HTTP

The old WebSocket stack also has a case-sensitive handshake quirk: proxied Connection: Upgrade works where a lowercase value can be dropped. It was reproduced while building the web port. Treat it as a version-specific diagnostic clue, not a durable network signature; intermediaries routinely normalize headers.

REST and application behavior

The original REST shape is /<controller>/<action>[/<id>]. A login request is POST /auth/login with user, pass, and version JSON fields. That pattern is only medium confidence and normally invisible without TLS termination. Stronger hunting looks for several of these less common paths in one service:

Successful sessions use a UUID-like session cookie. Failed login bodies such as INVALID_ACCOUNT and EXPIRED_ACCOUNT are product clues but should not be actively elicited on an unknown system. An authentication attempt changes server state and can notify or disconnect an operator.

Collector and anonymizer leads

The collector defaults to database host name rcs-server, database port 443, public port 80, controller port 4499, and 30-second heartbeat/controller intervals. Candidate configuration commonly refers to config.yaml, a database certificate, a server-signature file, a public directory, local cache, and component logs.

The examined anonymizer source uses the program name bbproxy, compile-time prefix /opt/bbproxy, and tunable files named version, cookie, key, proxyport, and nexthop. It adds X-Forwarded-For and X-Proxy-Version when those headers are absent. The RCS manual instead documents an installed /opt/rcsanon service listening on port 443. That difference is a version/package clue: search for both families and preserve the exact executable and configuration before deciding which snapshot fits.

Neither X-Forwarded-For nor X-Proxy-Version is unique. The source proxy preserves client-supplied versions, so their values are also weak attribution evidence unless a trusted upstream sanitized them.

Implant-side source describes short encrypted authentication posts and build- randomized URI/cookie names. Because no implant-to-collector session was run, this catalogue does not promote body length or a “static-looking site” into a standalone production signature. Use those traits only as scoped hunting hypotheses with corroborating collector evidence.

Windows backend host artifacts

The original source contains embedded licence and dongle material. The book does not repeat secret values as IOCs. On a seized authorized host, hash and restrict those files; do not copy credential values into shared alerting systems.

Licence and configuration schema

The RCS 9 licence is YAML with a distinctive combination of fields including serial, maintenance, platform entitlements, collector/anonymizer limits, hostname synchronization, correlation, deletion, signature, and integrity. The accompanying YARA rule requires several fields together and bounds file size.

Default backend configuration includes names for the CA, database certificate and key, listening port, heartbeat interval, backup directory, and shard. Most names are individually generic. Their value is in co-location with licence, service, certificate, and MongoDB evidence.

The default bootstrap administrator name and password are security findings, not recommended detection probes. Do not attempt them against a candidate. The presence of a default account in a preserved database can support a finding after authorized offline analysis, but an interactive login mutates sessions and audit state.

MongoDB and evidence storage

RCS target data forms coordinated collection families:

evidence.<24-hex-target-id>
aggregate.<24-hex-target-id>
grid.<24-hex-target-id>.files
grid.<24-hex-target-id>.chunks

Evidence collections use shard key {type, da, aid}, and aid is stored as a string in the original model. Binary evidence metadata points into the paired target GridFS bucket. These are high-value forensic indicators when found with global collections such as items, users, groups, sessions, audit, signatures, status, collectors, injectors, connectors, and task or alert queues.

Collection names alone still require care. A researcher could recreate them, and a backup may contain a partial or migrated database. Confirm indexes, field shape, ObjectId relationships, application files, and version evidence. Use read-only queries against a forensic clone; do not compact, repair, restore, or recalculate statistics on original evidence.

Behavioral and state indicators

Two lab-observed behaviors can assist diagnosis:

• A second login for the same username deletes the earlier session and queues a user-addressed logout push, so consoles can unexpectedly eject one another.
• In the reconstructed 9.2.3/9.6 pairing, the database component’s Monitor status can become stale after several minutes while REST, WSS, and push remain functional.

Both are low-confidence outside an already corroborated installation. Many systems enforce one session per user, and monitoring bugs are common. They are most useful for explaining observations, not finding RCS from scratch.

Explicit non-indicators

Do not treat any of the following as sufficient evidence:

• Server: nginx, nginx-styled error pages, or HTTP 444 alone;
• port 80, 443, 444, 442, 4499, or MongoDB ports alone;
• Ruby, EventMachine, MongoDB, nginx, a ten-year certificate, ACME Corp, collector, backup, or config alone;
• generic anonymizer certificate names such as server, test, apache, nginx, web, www, or default;
• the fictional names Operation Nightjar, A. Moretti, or R. Bianchi;
• host ports 44443/44444, console-web, rcs-db-lab:9.2, or Docker Compose; or
• the presence of exploit-source names without matching package, version, host, or case evidence.

The last group prevents the lab itself from contaminating historical hunts. Maintain explicit allowlists for authorized reconstruction systems and keep research traffic out of production detection corpora where possible.

Triage sequence

1. Preserve the triggering event and its sensor position.
2. Add one independent layer: network, host, database, certificate, or source artifact.
3. Compare the exact version and deployment mode with the fidelity map.
4. Exclude authorized research and forensic replay.
5. Acquire passively before any login or API request.
6. Separate platform identification, platform compromise, target compromise, and attribution.
7. Record absent expected evidence and plausible configuration changes.

The source rule files and current validation status are reproduced in Appendix G. They remain experimental until their target engines and representative negative corpora have been exercised.

Sources and evidence

• docker-lab/IOCs.md, original rcs-db, rcs-collector, rcs-anonymizer, installer, and database-model source.
• Chapters 5, 7, 9, 10, 12, and 13 for certificates, storage, edge behavior, security findings, detection confidence, and preservation.
• research/hackingteam-rcs/detections/ for the experimental source rules and validation ledger.
• LIMITATION: no collector/anonymizer/injector execution or implant PCAP; no claim of unique attribution from a single configurable default.