A Beginner's Guide to Tracking Malware Infrastructure

This write-up explains methods for building infrastructure queries to discover malware command-and-control and distribution servers by leveraging recurring indicators such as TLS certificate fields, HTTP titles/bodies, service banners, ASN/location, open directories, and regular expressions; it provides concrete examples and prebuilt Censys queries for several malware families (AsyncRAT, Cobalt Strike, Mythic, Havoc, DarkComet, Amadey, Qakbot, BianLian, Viper) to aid hunting and IOC generation.