<a name="top"></a>

<div align="center">

c2detect

Fingerprint the C2 server behind the beacon. Point it at network telemetry and it names the command-and-control framework — Cobalt Strike, Sliver, Mythic, Havoc, Brute Ratel, and 11+ more — with a confidence score and the exact indicators that matched.

Blue-team / defensive: detect known C2 infrastructure from telemetry. Passive by default; the active probe is opt-in and authorization-gated.

</div>

pip install cognis-c2detect
c2detect scan .            # → prioritized C2 findings in seconds, offline

<!-- cognis:example:start -->

See it work

Real, reproducible output — point it at a captured observation and it fingerprints the framework:

$ c2detect scan demos/01-cobalt-strike-network/observations.json
host: 203.0.113.10
  jarm=07d14d16d21d21d07c42d41d00041d24a458a375eef0c576d23a7bab9a9fb1  port=443

  CONF  SEV       FAMILY         INDICATORS
  -----------------------------------------
    48  critical  Cobalt Strike  jarm, port

  TOP: Cobalt Strike (48% / critical)
    - jarm [+42] matched '07d14d16d21d21d07c42d41d00041d24a458a375eef0c576d23a7bab9a9fb1'
    - port  [+6] matched '443'

c2detect: 3 C2 indicator(s) across 3 observation(s)

It fuses JA4/JARM/certificate/URI/port indicators against a bundled signature DB — and can emit ready-to-deploy Sigma and Suricata rules from those same signatures (c2detect rules), so a detection goes straight into your SIEM/IDS.

Why c2detect

| | threat-intel IP lists | JARM alone | c2detect | |---|:---:|:---:|:---:| | Names the C2 framework (not just "bad IP") | ✗ | partial | ✅ | | JA4 + JARM + cert + URI + port fusion | ✗ | ✗ | ✅ | | Confidence score + matched indicators | ✗ | ✗ | ✅ | | Generates Sigma / Suricata rules | ✗ | ✗ | ✅ | | Campaign correlation (shared infrastructure) | ✗ | ✗ | ✅ | | Runs offline, zero runtime deps | varies | ✓ | ✅ |

$ c2detect-emit --help
usage: c2detect [-h] [--version]
                {scan,match,db,rules,feeds,correlate,probe,self-check,mcp} ...

Fingerprint-match TLS/network observations against a bundled database of known
C2 frameworks (JA4/JARM/cert/URI/port indicators). Defensive triage only.

positional arguments:
  {scan,match,db,rules,feeds,correlate,probe,self-check,mcp}
    scan                Scan JSON observation files / telemetry text / dirs /
                        stdin.
    match               Match explicit indicators (--ja4/--jarm/--port/...).
    db                  List the bundled C2 signature database.
    rules               Generate Sigma / Suricata detection rules from the
                        signature DB.
    feeds               List/update/get the live abuse.ch Feodo-C2 + SSLBL
                        threat-intel feeds c2detect consumes (keyless; cached;
                        offline re-serve).
    correlate           Cluster many observations into shared-infrastructure
                        campaigns (same JARM/JA4S/cert across hosts = one
                        operator's estate).
    probe               AUTHORIZED ACTIVE: TLS-fingerprint a consented
                        host:port in scope (default OFF; needs --authorized +
                        --target-allowlist + rate limit).
    self-check          Scan bundled demo scenarios and report C2 detection
                        coverage.
    mcp                 Run the MCP server (stdio JSON-RPC).

options:
  -h, --help            show this help message and exit
  --version             show program's version number and exit

$ c2detect-emit self-check
c2detect self-check — bundled scenario coverage
================================================
  [DETECT    ] 01-basic                           Cobalt Strike
  [DETECT    ] 01-cobalt-strike-network           Cobalt Strike
  [DETECT    ] 02-deep                            Cobalt Strike
  [DETECT    ] 02-mixed-frameworks                Brute Ratel C4, Mythic, Sliver
  [DETECT    ] 03-behavioral                      Cobalt Strike
  [CLEAN     ] 03-benign-baseline                 (quiet)
  [DETECT    ] 04-sliver-mtls                     Cobalt Strike, Sliver
  [DETECT    ] 05-havoc-demon                     Havoc
  [DETECT    ] 06-mythic-agent                    Mythic
  [DETECT    ] 07-brute-ratel                     Brute Ratel C4
  [DETECT    ] 08-adaptixc2-teamserver            AdaptixC2
  [DETECT    ] 09-metasploit-meterpreter          Metasploit / Meterpreter
  [DETECT    ] 10-empire-windows                  PowerShell Empire
  [DETECT    ] 11-multi-framework-incident        AdaptixC2, Cobalt Strike, Havoc, Sliver
  [DETECT    ] 12-threat-hunt-jarm-sweep          Cobalt Strike, Sliver
  [feeds/corr] 13-threat-intel-feeds              (non-signature demo)
  [DETECT    ] 14-campaign-correlation            Cobalt Strike, Metasploit / Meterpreter
------------------------------------------------
  malicious detected : 14/14
  benign clean       : 1/1
  frameworks exercised: 8/21 in DB
  status             : HEALTHY

$ c2detect-emit db
FAMILY                            SEV       INDICATORS
------------------------------------------------------
Brute Ratel C4                    critical  ja3:1, jarm:1, uri:3, cert_quirk:2, port:2
Cobalt Strike                     critical  ja4s:1, ja3:1, ja3s:1, jarm:1, uri:5, uri_regex:1, http_banner:2, user_agent:1, cert_quirk:3, beacon:1, port:3
Metasploit / Meterpreter          critical  ja3:1, jarm:1, uri:3, cert_quirk:2, port:3
AdaptixC2                         high      uri:3, http_banner:4, cert_quirk:1, port:4
Covenant                          high      jarm:1, uri:3, http_banner:1, cert_quirk:1, port:3
Godzilla WebShell                 high      uri:3, uri_regex:1, cert_quirk:1, port:3
Havoc                             high      jarm:1, uri:3, http_banner:1, port:3
Mythic                            high      jarm:1, uri:2, http_banner:1, port:3
PoshC2                            high      uri:4, cert_quirk:2, port:2
PowerShell Empire                 high      ja3:1, uri:3, http_banner:1, port:3
Pupy RAT                          high      ja3:1, uri:2, cert_quirk:2, port:3
SILENTTRINITY                     high      uri:3, http_banner:1, beacon:1, port:3
Sliver                            high      ja4:1, ja4x:1, jarm:1, uri:5, cert_quirk:2, beacon:1, port:3
Caldera (MITRE)                   medium    uri:4, http_banner:1, beacon:1, port:5
Deimos C2                         medium    uri:3, http_banner:1, port:2
Koadic                            medium    uri:3, user_agent:1, port:3
Merlin                            medium    uri:2, http_banner:1, cert_quirk:1, port:1
NimPlant                          medium    uri:3, http_banner:1, user_agent:1, beacon:1, port:2
Villain                           medium    uri:3, http_banner:2, user_agent:1, port:3
Generic Beaconing Heuristic       low       beacon:1, port:6
Generic Self-Signed C2 Heuristic  low       cert_quirk:4, port:5

21 families in bundled signature DB.

Blocks above are real c2detect output — reproduce them from a clone.

<!-- cognis:example:end -->

Usage — step by step

c2detect is defensive C2-infrastructure triage: it scans telemetry/observation records against a bundled signature DB and flags beaconing, suspicious TLS fingerprints, and staging URIs. It is passive by default — scan/match/correlate/db/rules read input you provide and make no network calls (the optional --feeds only pulls public abuse.ch intel feeds, which can run fully offline from cache). A separate, opt-in and authorization-gated active probe (c2detect probe) can TLS-fingerprint a consented host you are authorized to assess — see Passive vs. active.

1. Install (Python 3.10+):

   pip install -e .            # or: pipx install c2detect
   

2. Scan observation files / telemetry text / a directory / stdin:

   c2detect scan telemetry.json
   cat telemetry.log | c2detect scan
   

3. Match explicit indicators on the command line (no file needed):

   c2detect match --ja4 t13d1516h2_8daaf6152771_b186095e22b6 --port 443 --beacon-interval 60 --jitter 0.1
   c2detect db        # list the bundled C2 signature database
   

   Or correlate a batch to cluster hosts that share C2 infrastructure into campaigns (see Campaign correlation):

   c2detect correlate telemetry.json          # which hosts are one operator's estate, and why
   

   Add --feeds to any scan/match to cross-reference host IPs / JA3s against the live abuse.ch Feodo-C2 + SSLBL threat-intel feeds (cached, offline-capable — see Live threat-intel feeds).
4. Read the output in JSON / SARIF / HTML / badge (e.g. for code scanning):

   c2detect scan telemetry.json --format sarif > c2.sarif
   c2detect scan telemetry.json --format json | jq '.findings'
   

5. Gate CI with --fail-on <severity> (exit non-zero at/above that severity). Optional --ai adds an opt-in Cognis-fleet LLM pass that degrades to rules if no backend is configured:

   - run: pip install -e . && c2detect scan telemetry.json --fail-on high
   

<a name="passive-vs-active"></a>

Passive vs. active

| | Passive (default) | Active (opt-in, gated) | |---|---|---| | Commands | scan · match · correlate · db · rules | probe | | Network | none (--feeds pulls public intel, offline-capable) | one TLS handshake + optional benign HTTP HEAD per target | | Default | on | OFF — refuses unless explicitly enabled | | Input | telemetry files / JSON / JSONL / text / stdin | a host:port in an explicit allowlist |

Passive mode is the safe default and the right tool for almost everything: feed it Zeek/Suricata/EDR exports (JSON, JSONL/NDJSON, or free text), IOC sightings, or a directory of captures, and it scores them against the bundled C2 signature DB. It never reaches out to the targets.

⚠️ Active mode — authorized defensive use only

c2detect probe opens a TLS handshake (plus an optional, benign HEAD /) to a host you are authorized to assess, records its certificate / JARM / banner, and runs the same passive scanner on the result — effectively an authorized openssl s_client that fingerprints a suspected C2 team server. It sends no payloads, runs no exploits, and takes no offensive action.

Active probing is OFF by default. To run a probe, all of the following are required, or it refuses:

1. --authorized — you assert you have documented authorization for every target in scope;
2. --target-allowlist <host|host:port|CIDR> (repeatable, or --allowlist-file) — a mandatory scope; any target not in it is refused and skipped;
3. a positive --rate-limit (connections/second; default 2.0).

A loud authorized-use banner is printed to stderr on every invocation. Probing a host without authorization may be illegal — you are responsible for your scope.

# Authorized assessment of a single consented team server:
c2detect probe teamserver.lab.example:50050 \
    --authorized \
    --target-allowlist teamserver.lab.