C2 Frameworks: Cobalt Strike and Sliver
Understand listener/agent architecture, beacon configuration, and operator workflow in C2 frameworks.
What is a C2 Framework?
A Command and Control (C2) framework is a platform for managing compromised systems during red team operations. It provides communication channels between the operator and implants, task management, post-exploitation modules, and logging.
Cobalt Strike
Cobalt Strike is the most widely used commercial C2 framework. Features:
- Malleable C2 profiles (customize network traffic to blend in)
- Beacon implant (HTTP, HTTPS, DNS, SMB communications)
- Team server for multi-operator collaboration
- Aggressor Script for automation
Frequently misused by real threat actors — recognize it in IR investigations.
All lessons in this course
- C2 Frameworks: Cobalt Strike and Sliver
- Living-Off-the-Land Binaries (LOLBins)
- Lateral Movement Techniques
- Red Team Report Writing