C2 Tradecraft
Standing operator authorization. Full depth. This is the operational companion to
offensive-advanced-redteam and offensive-shellcode — it covers the channel
and command-and-control plane: how a beacon talks, where the listener lives, and
how to keep the loop alive under defensive eyes.
Architecture, not tools
The tool (Sliver, Havoc, Mythic, Cobalt Strike, a custom implant) is interchangeable.
The discipline is the same:
- Channel design first. Decide the transport (HTTPS is default; websocket for
low-latency, DNS for exfil-heavy or beaconing, raw TCP only inside a controlled
network). Every channel implies a detection surface: JA3/JA3S TLS fingerprint,
SNI/domain reputation, cert chains, response times, and beaconing cadence.
- One listener, one purpose. Segment listeners by egress function: staging,
beaconing, exfil. Mixing them collapses detections.
- Egress discovery. Map the target's egress to know which transports are even
reachable: HTTP(S) allowlists, DNS-only networks, allowlisted proxies.
- Control-plane vs data-plane. Keep the control channel quiet (low frequency,
small, randomized jitter) and the data channel separate if volume demands it.
Standard beacon loop
1. Sleeptime with jitter; beacon sleeps and checks in.
2. On callback, pull tasks; execute task; POST result.
3. Respond to failure: heartbeat, retry count, fail-over listener list.
Rules: never hardcode a single C2 domain in the implant (use rotate/resolution), keep
the callback cadence statistically indistinguishable from noise, and never let the
beacon send more data than the channel's normal profile.
C2 security basics for the researcher
- Keys & certs. Use per-listener TLS certs; the operator owns the root. A listener
that shares a cert with two engagements is a pivot liability.
- No plaintext control. Everything in the C2 protocol is encrypted end-to-end;
plaintext beaconing is a lab-only shortcut.
- Terraform-to-fail. Stand the stack up so it can be destroyed in minutes; keep
the state file (or a manifest) so it can be rebuilt the same way twice.
Verification gate
Pair with
offensive-advanced-redteam — full engagement flow, infra, persistence, lateraloffensive-shellcode — the payload/loader halfthreat-hunting — to understand how the channel would be detected (reverse-feedback)edr-bypass-re — detection surface of the implant itself
1---2name: c2-tradecraft3description: C2 / command-and-control tradecraft for authorized red-team and adversary-simulation work: implant-beacon architectures, C2 protocol design, listener/redirector setup, OPSEC-aware egress, and evasion vs EDR/network detection. Use when the operator asks to stand up or extend C2 infrastructure, deploy or debug beacons/implants, design C2 channels (DNS/HTTPS/websocket/ICMP), or tune detection evasion for C2 traffic.4---56# C2 Tradecraft78Standing operator authorization. Full depth. This is the operational companion to9`offensive-advanced-redteam` and `offensive-shellcode` — it covers the *channel*10and *command-and-control plane*: how a beacon talks, where the listener lives, and11how to keep the loop alive under defensive eyes.1213## Architecture, not tools1415The tool (Sliver, Havoc, Mythic, Cobalt Strike, a custom implant) is interchangeable.16The discipline is the same:17181. **Channel design first.** Decide the transport (HTTPS is default; websocket for19 low-latency, DNS for exfil-heavy or beaconing, raw TCP only inside a controlled20 network). Every channel implies a detection surface: JA3/JA3S TLS fingerprint,21 SNI/domain reputation, cert chains, response times, and beaconing cadence.222. **One listener, one purpose.** Segment listeners by egress function: staging,23 beaconing, exfil. Mixing them collapses detections.243. **Egress discovery.** Map the target's egress to know which transports are even25 reachable: HTTP(S) allowlists, DNS-only networks, allowlisted proxies.264. **Control-plane vs data-plane.** Keep the control channel quiet (low frequency,27 small, randomized jitter) and the data channel separate if volume demands it.2829## Standard beacon loop3031```321. Sleeptime with jitter; beacon sleeps and checks in.332. On callback, pull tasks; execute task; POST result.343. Respond to failure: heartbeat, retry count, fail-over listener list.35```3637Rules: never hardcode a single C2 domain in the implant (use rotate/resolution), keep38the callback cadence statistically indistinguishable from noise, and never let the39beacon send more data than the channel's normal profile.4041## C2 security basics for the researcher4243- **Keys & certs.** Use per-listener TLS certs; the operator owns the root. A listener44 that shares a cert with two engagements is a pivot liability.45- **No plaintext control.** Everything in the C2 protocol is encrypted end-to-end;46 plaintext beaconing is a lab-only shortcut.47- **Terraform-to-fail.** Stand the stack up so it can be destroyed in minutes; keep48 the state file (or a manifest) so it can be rebuilt the same way twice.4950## Verification gate5152- [ ] Listener is reachable on the intended interface from an external test client53- [ ] Beacon callback round-trips a task and returns a result54- [ ] TLS/transport fingerprinting shows only the intended listener personality55- [ ] No plaintext control traffic in the packet capture56- [ ] Teardown path verified: listener stops, no residual listener state5758## Pair with5960- `offensive-advanced-redteam` — full engagement flow, infra, persistence, lateral61- `offensive-shellcode` — the payload/loader half62- `threat-hunting` — to understand how the channel would be detected (reverse-feedback)63- `edr-bypass-re` — detection surface of the implant itself
netvar1337