<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: implementing-http-c2-channels
description: >-
  Implement HTTP/HTTPS-based C2 channels with malleable profiles, domain fronting support, and traffic blending to evade network detection and proxy inspection.
domain: cybersecurity
subdomain: c2-frameworks
tags:
  - http-c2
  - https
  - malleable
  - traffic-blending
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1071.001"]
  frameworks: ["MITRE ATT&CK"]
  tools: ["cobalt-strike", "havoc", "nginx"]
---

# Implementing Http C2 Channels

## Overview

Implement HTTP/HTTPS-based C2 channels with malleable profiles, domain fronting support, and traffic blending to evade network detection and proxy inspection.

## Prerequisites

| Tool / Requirement | Details |
|---|---|
| `cobalt-strike` | Security tooling |
| `havoc` | Security tooling |
| `nginx` | Security tooling |
| C2 framework, HTTPS certificates, domain fronting infrastructure | Environment requirement |

## Quick Reference

```bash
# Quick start commands
node scripts/agent.js --help
node scripts/agent.js configure --protocol https --port 443 --profile malleable.profile
```

## Workflow

### Step 1: Configure HTTP Listener

```bash
node scripts/agent.js configure --protocol https --port 443 --profile malleable.profile
```

### Step 2: Deploy Redirector

```bash
node scripts/agent.js deploy --redirector nginx --backend c2.internal:8443
```

### Step 3: Test Traffic Blend

```bash
node scripts/agent.js test --profile malleable.profile --target https://target.com
```

## Detection

```yaml
title: Http C2 Channels Detection
id: 9609ce9a-cce5-4274-a762-1aad192b2d93
status: experimental
description: Detects suspicious activity related to implementing http c2 channels techniques in c2 frameworks context
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort: 443
    Initiated: "true"
  condition: selection
level: high
tags:
  - attack.t1071.001
  - attack.command_and_control
falsepositives:
  - Authorized penetration testing tools during scheduled assessments
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Http C2 Channels Detection | windows/network_connection | Sigma rule (high) |
| ATT&CK Coverage | MITRE ATT&CK | T1071.001 |

## Verification

- **Verify listener**: `node scripts/agent.js verify --protocol https --port 443`
- **Confirm traffic blend**: `node scripts/agent.js test --profile malleable.profile --target https://target.com`

## References

- MITRE ATT&CK: T1071.001
- Frameworks: MITRE ATT&CK
- Tools: cobalt-strike, havoc, nginx
