🔴 Red Team
C2 Framework Reference
Cobalt Strike, Sliver, Havoc, Metasploit, Brute Ratel — capabilities, detection signatures, OPSEC notes, and SOC detection queries for each.
⚠️ This reference is intended for authorised red team engagements and for defenders to understand C2 detection. Never use against systems without explicit written authorisation.
Command & Control Framework Reference
Cobalt Strike
Commercial
▼
The most widely used commercial red team platform. Beacon is the primary implant — staged or stageless, HTTP/HTTPS/DNS/SMB communication. Malleable C2 profiles allow arbitrary protocol impersonation.
Key Capabilities
Beacon, SOCKS proxy, pivoting, port forwarding, Kerberos operations, BOFs (Beacon Object Files) for in-memory execution, sleep masking, process injection (CreateRemoteThread, QueueAPC, Early Bird), token manipulation
Cost
$2,500–$10,000/year per seat (commercial). Cracked versions widely used by threat actors.
OPSEC Notes
Malleable C2 profiles can make beacon look like legitimate software. Avoid stage listener on public C2 — use redirectors. Use sleep masking against memory scanners. Process injection into signed binaries.
Detection Signatures
Windows EID 4688 (process creation) — rundll32/regsvr32 with network connections. Sysmon EID 3 — network connection from abnormal processes. MDE: suspicious process injection. Memory scan: beacon sleep pattern (static XOR key in older versions). BeaconEye/BeaconHunter detect in-memory. DNS: high-frequency short-TTL queries to single domain.
MITRE ATT&CK: T1055, T1071.001, T1573.001, T1021.002
Sliver
Open Source
▼
Open-source C2 by BishopFox. Go-based implants (slivers). Supports HTTP/HTTPS/DNS/WireGuard/mTLS. Binary implants can be generated for Windows/Linux/macOS. Widely adopted as free Cobalt Strike alternative.
Key Capabilities
Implants: beacons (sleep/jitter), sessions (interactive). Armory of 3rd-party BOFs. Sideloading, shellcode injection, pivots, port forward, SOCKS5 proxy, Kerberos/NTLM operations
Cost
Free (Apache 2.0). Actively maintained.
OPSEC Notes
Use WireGuard or mTLS C2 — harder to detect than HTTP/HTTPS. Regenerate implants frequently to avoid hash-based detection. Use stager URLs that 404 after single use.
Detection Signatures
Go runtime artifacts (large binary size ~7-12MB). Network: repeated beaconing pattern. Implant filename/mutex artifacts. Sysmon EID 22 (DNS queries). Process hollowing if used. EDR: Sliver shellcode signatures improving rapidly (2024+).
MITRE ATT&CK: T1055, T1071.001, T1095, T1572
Havoc C2
Open Source
▼
Modern open-source C2 framework. Demon agent written in C. Supports HTTP/HTTPS/SMB. Gained popularity due to advanced evasion: sleep obfuscation (Foliage/Ekko), stack spoofing, indirect syscalls, AMSI/ETW patching.
Key Capabilities
Demon agent with sleep obfuscation, stack spoofing, indirect syscalls, AMSI patching, token impersonation, process injection, BOF support, pivoting
Cost
Free (GNU General Public License)
OPSEC Notes
Enable sleep obfuscation and stack spoofing in demon profile. Use indirect syscalls to avoid EDR hooks. Build with custom compiler flags to avoid static signatures.
Detection Signatures
Despite evasion: process memory anomalies detectable by memory scanners. Network: HTTP beacon pattern. Stack traces during sleep may appear abnormal to memory scanners. Recent EDR improvements catching Havoc demon variants.
MITRE ATT&CK: T1055, T1071.001, T1562.001
Metasploit Framework
Open Source
▼
The most widely known exploitation and post-exploitation framework. Meterpreter is the primary implant. Best suited for initial access testing and automated exploitation — less suited for long-term C2 due to well-known signatures.
Key Capabilities
Exploits (1000+), Meterpreter (Windows/Linux/macOS/Android), post-exploitation modules, pivoting, port forward, persistence, hashdump, token impersonation, Kiwi (Mimikatz integration)
Cost
Free (MSF Community). Metasploit Pro: commercial.
OPSEC Notes
Stage Meterpreter — avoid stageless for initial access. Use HTTPS listeners with valid certs. Encode payloads (shikata_ga_nai is detected by most EDR). Custom stagers preferred over default msfvenom output.
Detection Signatures
Default Meterpreter signatures detected by all major AV/EDR. Network: TLS certificate default org name ("msf"). Stage URL pattern (/ABCDEF). Process injection into explorer.exe/svchost.exe. Sysmon: cmd.exe spawned from unexpected parent.
MITRE ATT&CK: T1059.001, T1055, T1071.001
Brute Ratel C4
Commercial
▼
Commercial adversary simulation framework. Badger is the implant. Known for advanced EDR evasion — bypasses many EDR products at launch. Used by Scattered Spider, ALPHV/BlackCat, and other threat actors. Leaked version widely used by criminals.
Key Capabilities
Badger implant, process injection, sleep masking, indirect syscalls, PE reflective loading, SOCKS4a proxy, pivoting, Kerberos operations, API hashing
Cost
$2,500/year. Leaked cracked version used by threat actors.
OPSEC Notes
Advanced evasion built-in — indirect syscalls, PE stomping, sleep masking. Use profile customisation to change network patterns. Rotate domains and certificates frequently.
Detection Signatures
Despite advanced evasion: leaked version has static signatures. Commercial version: memory anomalies detectable. Network: distinctive HTTP patterns in older versions. MDE improving detection (2024 signatures added). Associated with known threat actor TTPs.
MITRE ATT&CK: T1055, T1071.001, T1562.001
C2 Framework Comparison
| Feature | Cobalt Strike | Sliver | Havoc | Metasploit | Brute Ratel |
|---|---|---|---|---|---|
| Language | Java (server) / C (beacon) | Go (server+implant) | C++ (server) / C (demon) | Ruby (server) / C (implant) | Rust (server) / C (badger) |
| Cost | $2,500–10K/seat | Free | Free | Free (Pro: paid) | $2,500/year |
| EDR Evasion | High (with profiles) | Medium | Very High | Low (default) | Very High |
| Sleep Masking | Yes (with BOFs) | Partial | Yes (Foliage/Ekko) | No | Yes |
| Indirect Syscalls | Via BOFs | Partial | Yes (built-in) | No | Yes |
| BOF Support | Yes (native) | Yes (Armory) | Yes | No | Yes |
| SMB C2 | Yes | Yes | Yes | Yes | Yes |
| DNS C2 | Yes | Yes | No | Yes | No |
| WireGuard/mTLS | No | Yes | No | No | No |
| Multiplayer Team | Yes | Yes | Limited | No (Pro: yes) | Yes |
| Community/Support | Commercial + community | Active OSS | Active OSS | Very large community | Commercial |
| Used by APTs | Yes — widely | Growing | Growing | Yes — widely | Yes (leaked version) |
| Detection Rate (default) | Medium | Low-Medium | Low | Very High | Low (commercial) |
SOC Detection Queries
Cobalt Strike Beacon — KQL (Microsoft Sentinel)
// Cobalt Strike beacon characteristic: process spawning + network connection
SecurityEvent
| where EventID == 4688
| where ParentProcessName has_any ("explorer.exe","winlogon.exe","services.exe")
| where NewProcessName has_any ("rundll32.exe","regsvr32.exe","mshta.exe","wscript.exe","cscript.exe")
| join kind=inner (
DeviceNetworkEvents
| where RemotePort in (80,443,8080,8443)
| where InitiatingProcessFileName has_any ("rundll32.exe","regsvr32.exe","mshta.exe")
) on $left.SubjectLogonId == $right.InitiatingProcessAccountName
| project TimeGenerated, ParentProcessName, NewProcessName, RemoteIP=RemoteIP, RemotePort
Malleable C2 — Suspicious SSL cert patterns (KQL)
// Cobalt Strike default SSL cert organisation
DeviceNetworkEvents
| where RemotePort in (443,8443)
| extend CertInfo = tostring(parse_json(AdditionalFields).cert_subject)
| where CertInfo has_any ("Major Cobalt Strike","0.0.0.0","something.something.something")
| summarize count() by DeviceName, RemoteIP, CertInfo, bin(Timestamp,1h)
Generic C2 Beacon — Periodic outbound connections (SPL)
index=network sourcetype=firewall action=allowed
| eval hour=strftime(_time, "%Y-%m-%d %H")
| stats count, avg(bytes_out) as avg_bytes, stdev(bytes_out) as sd_bytes by src_ip, dest_ip, dest_port, hour
| where count > 10 AND sd_bytes < 500 // High frequency, consistent size = beacon
| eval beacon_score = if(sd_bytes < 100, "HIGH", if(sd_bytes < 300, "MEDIUM", "LOW"))
| where beacon_score in ("HIGH","MEDIUM")
| sort -count
Sliver implant — Go binary network artifacts
// Sliver Go binaries — large executable + network connection
DeviceProcessEvents
| where ProcessVersionInfoFileDescription == "" // Go binaries often have no version info
| where FileSize > 7000000 and FileSize < 15000000 // Go binaries 7-12MB typical
| join kind=inner (
DeviceNetworkEvents
| where RemotePort in (443,80,4444,8080)
) on DeviceId, InitiatingProcessId=ProcessId
| project Timestamp, DeviceName, FileName, FileSize, RemoteIP, RemotePort
C2 Protocol Reference
| Protocol | Stealth | Speed | Detection Method | Best Used When |
|---|---|---|---|---|
| HTTP/HTTPS | Medium | High | SSL inspection, beacon timing, JA3 fingerprint | Most engagements — blends with web traffic |
| DNS C2 | High | Low | Unusually high DNS query volume, long TXT records, NXDomain responses | Air-gapped-adjacent environments; low-bandwidth exfil |
| SMB (named pipe) | High (internal) | High | Pipe creation events (Sysmon EID 17/18), lateral movement patterns | Post-exploitation internal pivoting between hosts |
| ICMP | Medium | Very Low | Deep packet inspection; payload size anomalies | Legacy environments without DNS filtering |
| WireGuard (Sliver) | High | High | Port 51820/UDP; unusual UDP tunnel | Environments where custom ports are less scrutinised |
| mTLS | High | High | Mutual certificate auth traffic; unusual cert patterns | High-security target environments |
| Domain Fronting (CDN) | Very High | High | CDN provider policies; HOST header analysis | Heavily monitored environments (most CDNs now block) |
| QUIC/HTTP3 | Medium-High | Very High | DPI on UDP 443; QUIC fingerprinting | Modern network environments with QUIC allowed |
C2 Redirector Architecture
Never expose your C2 server directly. Use redirectors — intermediate servers that forward traffic to the real C2 only when the right beacon is received, otherwise serve legitimate content.
## Apache mod_rewrite redirector — filter non-beacon traffic to decoy
## Only forward traffic matching Cobalt Strike beacon User-Agent to real C2
# /etc/apache2/sites-available/redirector.conf
SSLEngine On
SSLCertificateFile /etc/letsencrypt/live/yourdomain.com/cert.pem
SSLCertificateKeyFile /etc/letsencrypt/live/yourdomain.com/privkey.pem
RewriteEngine On
# Forward valid beacon traffic to C2 team server
RewriteCond %{HTTP_USER_AGENT} "Mozilla/5.0 \(Windows NT 6\.1; WOW64\) AppleWebKit"
RewriteRule ^/updates/(.*)$ https://TEAMSERVER_IP/updates/$1 [P,L]
# All other traffic → legitimate decoy site (or 404)
RewriteRule ^/(.*)$ https://legitimate-site.com/$1 [R=302,L]
## Nginx equivalent:
# location /updates/ {
# if ($http_user_agent !~ "Mozilla/5.0 \(Windows NT 6\.1") { return 302 https://google.com; }
# proxy_pass https://TEAMSERVER_IP;
# }