C2 Frameworks: Cobalt Strike and Sliver

A Command and Control (C2) framework is a platform for managing compromised systems during red team operations. It provides communication channels between the operator and implants, task management, post-exploitation modules, and logging.

Cobalt Strike is the most widely used commercial C2 framework. Features:

• Malleable C2 profiles (customize network traffic to blend in)
• Beacon implant (HTTP, HTTPS, DNS, SMB communications)
• Team server for multi-operator collaboration
• Aggressor Script for automation

Frequently misused by real threat actors — recognize it in IR investigations.

The Beacon payload supports:

• Sleep intervals with jitter (evade timing-based detection)
• Encrypted communications
• In-memory execution (no files on disk)
• SOCKS proxy through compromised hosts

Sliver (BishopFox) is a free, open-source C2 framework:

• Supports mTLS, HTTP/S, DNS, WireGuard channels
• Implants generated in Go (cross-platform)
• Built-in implant obfuscation (Garble)
• Multi-player support

Metasploit's Meterpreter is a basic C2, but dedicated frameworks like Cobalt Strike and Sliver offer:

• Better operational security (malleable/custom protocols)
• Multi-operator support
• More sophisticated post-exploitation
• Logging and reporting for red team engagements

Operational security for C2 infrastructure:

• Use redirectors (nginx) to hide the true C2 server
• Domain fronting (route through CDN to hide C2 domain)
• Obtain legitimate-looking domains (categorized by web filters)
• Use separate infrastructure per engagement

Blue teams detect C2 via:

• Unusual HTTP User-Agent strings or headers
• Periodic beacon intervals (regular outbound connections)
• DNS queries to newly registered/low-reputation domains
• Yara rules matching Cobalt Strike/Sliver signatures
• Memory scanning for known implant patterns

Common C2 post-exploitation capabilities:

• Credential dumping (Mimikatz integration)
• Lateral movement (WMI, PSExec, SMB)
• Persistence (scheduled tasks, registry keys)
• Screenshot, keylogger, file browser
• Pivoting through compromised hosts

Cobalt Strike's Malleable C2 profiles customize beacon traffic to mimic legitimate applications (Slack, Teams, OneDrive). Network defenses signature-match on default profiles — custom profiles evade these signatures.

C2 frameworks are legitimate penetration testing tools that require explicit written authorization. Using C2 frameworks against unauthorized targets is a federal crime. Ensure rules of engagement clearly define:

• Scope of compromised systems allowed
• Data exfiltration restrictions
• Out-of-scope targets

IR teams look for:

• Unusual parent-child process relationships (Word spawning PowerShell)
• LOLBins making external network connections
• Encoded PowerShell commands in event logs
• Scheduled tasks or services with unusual names
• Cobalt Strike watermarks in memory (Team ID in Beacon)

What feature of Cobalt Strike allows operators to customize beacon network traffic to mimic legitimate services and evade detection?

C2 frameworks (Cobalt Strike, Sliver) manage implants on compromised systems with encrypted channels, post-exploitation modules, and multi-operator support. Malleable C2 profiles evade detection by mimicking legitimate traffic. Detection: beacon intervals, unusual DNS, Yara signatures. Always requires written authorization — misuse is criminal.