<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: configuring-nighthawk-c2
description: >-
  Configure Nighthawk C2 framework for advanced red team operations including evasive implant generation, indirect syscalls, and hardware-breakpoint based unhooking.
domain: cybersecurity
subdomain: c2-frameworks
tags:
  - nighthawk
  - evasion
  - syscall
  - unhooking
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1059"]
  frameworks: ["MITRE ATT&CK"]
  tools: ["nighthawk", "syscall", "edr"]
---

# Configuring Nighthawk C2

## Overview

Configure Nighthawk C2 framework for advanced red team operations including evasive implant generation, indirect syscalls, and hardware-breakpoint based unhooking.

## Prerequisites

| Tool / Requirement | Details |
|---|---|
| `nighthawk` | Security tooling |
| `syscall` | Security tooling |
| `edr` | Security tooling |
| Nighthawk license, deployment infrastructure, EDR testing lab | Environment requirement |

## Quick Reference

```bash
# Quick start commands
node scripts/agent.js --help
node scripts/agent.js init --config nighthawk.yml
```

## Workflow

### Step 1: Initialize Nighthawk

```bash
node scripts/agent.js init --config nighthawk.yml
```

### Step 2: Configure Implant

```bash
node scripts/agent.js configure --implant-type dll --syscall indirect
```

### Step 3: Deploy and Evade

```bash
node scripts/agent.js deploy --target 10.0.0.50 --unhook hwbp
```

## Detection

```yaml
title: Nighthawk C2 Detection
id: fea9ce1d-9054-426c-9a48-f42c041dbf90
status: experimental
description: Detects suspicious activity related to configuring nighthawk c2 techniques in c2 frameworks context
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort: 443
    Initiated: "true"
  condition: selection
level: high
tags:
  - attack.t1059
  - attack.command_and_control
falsepositives:
  - Authorized penetration testing tools during scheduled assessments
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Nighthawk C2 Detection | windows/network_connection | Sigma rule (high) |
| ATT&CK Coverage | MITRE ATT&CK | T1059 |

## Verification

- **Verify initialization**: `node scripts/agent.js verify --component server`
- **Confirm implant**: `node scripts/agent.js verify --component implant`

## References

- MITRE ATT&CK: T1059
- Frameworks: MITRE ATT&CK
- Tools: nighthawk, syscall, edr
