c2detect identifies which command-and-control framework — Cobalt Strike, Sliver, Mythic, Havoc, Brute Ratel and more — sits behind network telemetry, built for defensive triage on authorized networks.
| Tool | cognis-digital/c2detect — passive C2 infrastructure fingerprinter that names the framework behind beaconing telemetry from a bundled signature DB |
| Category | Blue-team detection / network threat hunting CLI (Python, zero runtime dependencies) |
| Primary Use | Scanning Zeek/Suricata/EDR telemetry exports against a 21-family C2 signature database fusing JA4, JARM, JA3, certificate quirks, URIs and ports, then emitting Sigma/Suricata rules |
| Safe Use | Defensive triage on telemetry from networks you are authorized to defend; passive by default, with the active probe subcommand opt-in, authorization-gated, allowlist-scoped and rate-limited |
| Telemetry Note | Passive modes make no network calls toward targets (only optional abuse.ch feed pulls); the active probe performs a single TLS handshake plus optional benign HEAD / per allowlisted host and prints an authorized-use banner to stderr, making its activity observable and attributable on both ends |
Most threat-intel tooling stops at "this IP is bad," which tells an incident responder almost nothing about tradecraft. c2detect, published by cognis-digital as cognis-c2detect on PyPI, goes a step further and names the command-and-control framework itself: point it at network telemetry and it will tell you whether the infrastructure belongs to Cobalt Strike, Sliver, Mythic, Havoc, Brute Ratel C4, or any of the 21 families in its bundled signature database. The project's positioning in the README is unambiguous — this is blue-team tooling for defensive triage, passive by default, with any active capability deliberately locked behind authorization gates.
The core mechanism is indicator fusion. Rather than leaning on a single signal like a JARM hash, c2detect combines JA4, JA4S, JA4X, JA3, JA3S, JARM, certificate quirks, URI and URI-regex patterns, HTTP banners, user-agent strings, beaconing behavior, and port conventions into a weighted scoring pass. The demo output in the README shows the shape of a finding clearly: a confidence percentage, a severity rating, the named family, and — critically for analyst review — the exact indicators that contributed to the score. A Cobalt Strike hit at 48% confidence breaks down into a jarm match worth +42 points and a port match worth +6, so the verdict is auditable rather than opaque.
The signature database itself is worth reading closely. The db subcommand lists per-family indicator counts, and the distribution tells you where detection quality comes from: Cobalt Strike carries the richest fingerprint (eleven distinct indicator types including uri_regex, http_banner, and beacon), while Sliver is covered through ja4/ja4x/jarm plus URI and certificate quirks. The list runs from modern red-team frameworks (Havoc, Mythic, AdaptixC2, PoshC2, NimPlant) through classics (Metasploit/Meterpreter, PowerShell Empire, SILENTTRINITY, Pupy RAT, Koadic, Merlin, Covenant) down to two generic heuristics — beaconing behavior and self-signed certificates — that catch infrastructure the named families miss. The self-check subcommand exercises 14 bundled malicious scenarios and one benign baseline, and the README's output shows 14/14 detection with the baseline correctly staying quiet.
What elevates c2detect above a research curiosity is the pipeline from detection to deployment. The rules subcommand generates ready-to-deploy Sigma and Suricata rules directly from the same signature database, meaning a triaged finding can be pushed into a SIEM or IDS without hand-translation. Output formats include JSON, SARIF, and HTML, and a --fail-on <severity> flag turns the scanner into a CI gate that exits non-zero at or above a chosen severity. That combination — telemetry in, validated detection rules out — is exactly the loop most SOC teams struggle to close quickly.
The correlate subcommand addresses campaign attribution, a genuinely interesting architectural choice. It clusters many observations into shared-infrastructure campaigns on the premise that hosts exhibiting the same JARM, JA4S, or certificate across a fleet likely belong to one operator's estate. For an analyst triaging a large telemetry export, this converts hundreds of individual findings into a small number of actionable clusters, each with the evidence for why the clustering happened. It is analytical grouping over your own data, not attribution of real-world actors.
Threat-intel integration is handled through the optional --feeds flag, which cross-references host IPs and JA3 fingerprints against abuse.ch's Feodo-C2 and SSLBL feeds. The implementation details matter for operational environments: the feeds are keyless, cached, and re-servable fully offline, which makes the tool viable on an air-gapped sensor or in an edge deployment where egress is tightly controlled. Even without feeds, the bundled signature DB works completely offline — the entire runtime is standard-library Python with zero external dependencies, which simplifies both installation and supply-chain review.
The passive/active split is where the project's ethics become engineering. Passive commands — scan, match, correlate, db, rules — read only the input you provide and make no network calls toward targets. The single active capability, c2detect probe, performs one TLS handshake plus an optional benign HEAD / against a host you explicitly scope, records the certificate/JARM/banner, and runs the same passive scanner on the result — the README aptly describes it as an authorized openssl s_client. It sends no payloads, runs no exploits, and takes no offensive action.
Crucially, probe refuses to run without three conditions satisfied simultaneously: the --authorized flag asserting documented authorization, a mandatory --target-allowlist (host, host:port, or CIDR, repeatable or via --allowlist-file) that any unlisted target is refused against, and a positive --rate-limit defaulting to 2.0 connections per second. Every invocation prints a loud authorized-use banner to stderr. This is a design pattern other tool authors should study: the guardrails are not documentation, they are runtime-enforced refusals.
The README also documents an mcp subcommand that runs the tool as a stdio JSON-RPC server, exposing its capabilities to MCP-aware automation, and an opt-in --ai flag that adds a LLM enrichment pass which degrades gracefully to pure rule matching when no Cognis backend is configured. The match subcommand accepts explicit indicators on the command line — --ja4, --jarm, --port, --beacon-interval, --jitter — so an analyst holding a single indicator from a report can test it against the DB without preparing a telemetry file.
Installation is a one-liner for Python 3.10+: pip install cognis-c2detect, or pipx install c2detect for an isolated environment, after which c2detect scan <telemetry.json> produces prioritized findings in seconds. The repository runs CI, and the license is listed as a custom COCL 1.0, so teams doing procurement review should read the terms before wide deployment. With 36 stars and active recent development, it is a young project, but the self-check coverage suite, offline-first design, and enforced authorization gates suggest a codebase built with production defensive workflows in mind rather than a weekend proof-of-concept.
For defenders, the telemetry story cuts both ways and is worth stating plainly. Passive scanning is invisible to adversaries because it touches nothing outside your own data. If your team does run an authorized probe against a lab or consented team server, the target sees exactly one TLS handshake and one benign HEAD request per run, rate-limited by default — activity that is fully attributable and within scope. That symmetry, where even the active mode is designed to be minimal and observable, is the strongest signal of the project's defensive intent, and it is what makes c2detect a comfortable addition to an authorized detection engineering toolkit.
cognis-digital/c2detect.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.