C2

Offensive Security

WebDAV Covert Channel on SecurityListing: A covert channel technique that uses WebDAV protocol features to deliver malicious payloads and establish C2 communication while bypassing security controls.

Threat Intelligence Platforms

HYAS Adversary Infrastructure Platform on SecurityListing: Platform for tracking adversary infrastructure and C2 communications

Threat Hunting

Censys Internet Intelligence Platform on SecurityListing: Internet intelligence platform for asset discovery and threat analysis

Threat Intelligence Platforms

SSLBL - SSL Blacklist on SecurityListing: A project that detects malicious SSL connections by identifying and blacklisting SSL certificates used by botnet C&C servers and identifying JA3 fingerprints to detect and block malware botnet C&C communication.

Threat Intelligence Platforms

IronNet IronRadar on SecurityListing: Proactive C2 threat intelligence feed for detecting adversary infrastructure

Offensive Security

Brute Ratel C4 on SecurityListing: Advanced command and control tool for red teaming and adversary simulation with extensive features and evasion capabilities.

Security Operations

GHH - Google Hack Honeypot on SecurityListing: GHH is a honeypot tool to defend against search engine hackers using Google as a hacking tool.

Network Detection and Response

ThreatBook Threat Detection Platform (TDP) on SecurityListing: Network detection and response platform with threat intel fusion and automation

Penetration Testing

PoshC2 on SecurityListing: A proxy aware C2 framework for penetration testing, red teaming, post-exploitation, and lateral movement with modular format and highly configurable payloads.

Penetration Testing

Cobalt Strike's ExternalC2 framework on SecurityListing: A specification/framework for extending default C2 communication channels in Cobalt Strike

Threat Hunting

Censys Threat Hunting on SecurityListing: Proactive threat hunting platform for detecting adversary infrastructure

Offensive Security

Cobalt Strike HTTP C2 Redirectors with Apache mod_rewrite on SecurityListing: Using Apache mod_rewrite as a redirector to filter C2 traffic for Cobalt Strike servers.

Penetration Testing

Randomized Malleable C2 Profiles Made Easy on SecurityListing: Tool for randomizing Cobalt Strike Malleable C2 profiles to evade static, signature-based detection controls.