# c2detect **Repository Path**: wangbing69/c2detect ## Basic Information - **Project Name**: c2detect - **Description**: No description available - **Primary Language**: Unknown - **License**: Not specified - **Default Branch**: main - **Homepage**: None - **GVP Project**: No ## Statistics - **Stars**: 0 - **Forks**: 0 - **Created**: 2026-06-15 - **Last Updated**: 2026-06-15 ## Categories & Tags **Categories**: Uncategorized **Tags**: None ## README

# C2DETECT ### C2 server fingerprinter — Cobalt Strike, Sliver, Mythic, Havoc, Brute Ratel

[![PyPI](https://img.shields.io/pypi/v/cognis-c2detect.svg?color=6b46c1)](https://pypi.org/project/cognis-c2detect/) [![CI](https://github.com/cognis-digital/c2detect/actions/workflows/ci.yml/badge.svg)](https://github.com/cognis-digital/c2detect/actions) [![License: COCL 1.0](https://img.shields.io/badge/License-COCL%201.0-2b6cb0.svg)](LICENSE) [![Suite](https://img.shields.io/badge/Cognis-Neural%20Suite-6b46c1.svg)](https://github.com/cognis-digital) *Red Team / Offensive — adversary tooling for authorized engagements.*

```bash pip install cognis-c2detect c2detect scan . # → prioritized findings in seconds ``` ## Usage — step by step `c2detect` is defensive C2-infrastructure triage: it scans telemetry/observation records against a bundled signature DB and flags beaconing, suspicious TLS fingerprints, and staging URIs. No network, no active capability. 1. **Install** (Python 3.10+): ```bash pip install -e . # or: pipx install c2detect ``` 2. **Scan observation files / telemetry text / a directory / stdin**: ```bash c2detect scan telemetry.json cat telemetry.log | c2detect scan ``` 3. **Match explicit indicators** on the command line (no file needed): ```bash c2detect match --ja4 t13d1516h2_8daaf6152771_b186095e22b6 --port 443 --beacon-interval 60 --jitter 0.1 c2detect db # list the bundled C2 signature database ``` 4. **Read the output** in JSON / SARIF / HTML / badge (e.g. for code scanning): ```bash c2detect scan telemetry.json --format sarif > c2.sarif c2detect scan telemetry.json --format json | jq '.findings' ``` 5. **Gate CI** with `--fail-on ` (exit non-zero at/above that severity). Optional `--ai` adds an opt-in Cognis-fleet LLM pass that degrades to rules if no backend is configured: ```yaml - run: pip install -e . && c2detect scan telemetry.json --fail-on high ``` ## Contents - [Why c2detect?](#why) · [Features](#features) · [Quick start](#quick-start) · [Example](#example) · [Detection depth](#detection-depth) · [GitHub Action](#github-action) · [Status badge](#status-badge) · [HTML report](#html-report) · [AI mode](#ai-mode) · [Architecture](#architecture) · [AI stack](#ai-stack) · [How it compares](#how-it-compares) · [Integrations](#integrations) · [Install anywhere](#install-anywhere) · [Related](#related) · [Contributing](#contributing) ## Why c2detect? C2 server fingerprinter — Cobalt Strike, Sliver, Mythic, Havoc, Brute Ratel — without standing up heavyweight infrastructure. `c2detect` is single-purpose, scriptable, and self-hostable: point it at a target, get prioritized results in the format your workflow already speaks (table · JSON · SARIF), gate CI on it, and let agents drive it over MCP.