<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: building-custom-c2-frameworks
description: >-
  Design and build custom command-and-control frameworks for adversary simulation,
  implementing encrypted communication channels, modular agent architectures,
  and evasive C2 profiles to test detection capabilities.
domain: cybersecurity
subdomain: adversary-simulation
tags:
  - c2-framework
  - command-and-control
  - red-team
  - covert-channels
  - malleable-profiles
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1071.001", "T1573.002", "T1132.001", "T1095"]
  frameworks: ["MITRE ATT&CK"]
  tools: ["python3", "sliver", "mythic", "openssl"]
---

# Building Custom C2 Frameworks

## Overview

Custom C2 frameworks enable red teams to simulate adversary command-and-control
infrastructure that evades standard network detection. Building custom C2 tests
whether defenders can detect novel communication channels beyond known tool
signatures like Cobalt Strike or Metasploit beacons.

## Prerequisites

| Tool / Requirement | Details |
|---|---|
| `python3` | Security tooling |
| `openssl` | Security tooling |
| `docker` | Security tooling |
| Understanding of network protocols (HTTP/S, DNS, ICMP) | Environment requirement |
| TLS certificate infrastructure for encrypted channels | Environment requirement |
| Isolated network environment for testing | Environment requirement |

## Workflow

### Step 1: Design C2 Architecture

```
C2 Architecture:
├── Listener — Accepts agent callbacks
│   ├── HTTPS with domain-fronted traffic
│   ├── DNS TXT record tunneling
│   └── WebSocket over legitimate CDN
├── Agent — Implant on target system
│   ├── Modular task execution
│   ├── Encrypted communication
│   ├── Jitter and sleep intervals
│   └── Anti-analysis checks
├── Teamserver — Operator interface
│   ├── Multi-operator support
│   ├── Task queue and results
│   └── Logging and audit trail
└── Redirectors — Traffic obfuscation layer
```

### Step 2: Implement Basic C2 Server

```python
"""Minimal HTTPS C2 listener for simulation testing."""
import ssl
from http.server import HTTPServer, BaseHTTPRequestHandler
import json

class C2Handler(BaseHTTPRequestHandler):
    tasks: dict[str, list] = {}
    results: dict[str, list] = {}

    def do_POST(self) -> None:
        length = int(self.headers.get("Content-Length", 0))
        data = json.loads(self.rfile.read(length))
        agent_id = data.get("id", "unknown")
        self.results.setdefault(agent_id, []).append(data)
        tasks = self.tasks.pop(agent_id, [])
        self.send_response(200)
        self.end_headers()
        self.wfile.write(json.dumps({"tasks": tasks}).encode())
```

### Step 3: Generate C2 Profile

```bash
# Generate malleable C2 profile
node scripts/agent.js generate-profile --protocol https --jitter 30 --sleep 60

# Validate profile against known signatures
node scripts/agent.js validate-profile --profile custom.profile
```

### Step 4: Test Detection

```bash
# Generate network traffic for detection testing
node scripts/agent.js simulate-traffic --profile custom.profile --duration 300

# Analyze traffic against NIDS signatures
node scripts/agent.js analyze-detection --pcap capture.pcap
```

## Detection

```yaml
title: Custom C2 Frameworks Detection
id: 95150dd2-71b3-495b-85cd-4a428f0899c9
status: experimental
description: Detects suspicious activity related to building custom c2 frameworks techniques in adversary simulation context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*building*custom*"
  condition: selection
level: high
tags:
  - attack.t1071.001
  - attack.t1573.002
  - attack.t1132.001
  - attack.t1095
  - attack.execution
falsepositives:
  - Authorized red team exercises during approved testing windows
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Custom C2 Frameworks Detection | windows/process_creation | Sigma rule (high) |
| ATT&CK Coverage | MITRE ATT&CK | T1071.001, T1573.002, T1132.001, T1095 |

## Verification

- [ ] C2 server accepts agent callbacks over encrypted channel
- [ ] Agent communication uses configurable jitter and sleep
- [ ] Traffic profile evades default NIDS signatures
- [ ] Detection gaps documented for blue team remediation
- [ ] All C2 infrastructure decommissioned after exercise

## References

- [Sliver C2](https://github.com/BishopFox/sliver) — Open-source adversary emulation framework
- [Mythic C2](https://github.com/its-a-feature/Mythic) — Modular C2 platform
