<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: configuring-brute-ratel-c2
description: >-
  Configure Brute Ratel C4 for advanced adversary simulation including badger deployment, sleep masking, syscall evasion, and EDR bypass capabilities.
domain: cybersecurity
subdomain: c2-frameworks
tags:
  - brute-ratel
  - brc4
  - badger
  - edr-bypass
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1059"]
  frameworks: ["MITRE ATT&CK"]
  tools: ["brute-ratel", "syscall", "edr"]
---

# Configuring Brute Ratel C2

## Overview

Configure Brute Ratel C4 for advanced adversary simulation including badger deployment, sleep masking, syscall evasion, and EDR bypass capabilities.

## Prerequisites

| Tool / Requirement | Details |
|---|---|
| `brute-ratel` | Security tooling |
| `syscall` | Security tooling |
| `edr` | Security tooling |
| Brute Ratel C4 license, deployment infrastructure, EDR testing environment | Environment requirement |

## Quick Reference

```bash
# Quick start commands
node scripts/agent.js --help
node scripts/agent.js init --license-path brc4.lic --listener https
```

## Workflow

### Step 1: Initialize BRC4

```bash
node scripts/agent.js init --license-path brc4.lic --listener https
```

### Step 2: Configure Badger

```bash
node scripts/agent.js configure --badger-type exe --sleep-mask stack-encrypt
```

### Step 3: Deploy and Test

```bash
node scripts/agent.js deploy --target 10.0.0.50 --evasion full
```

## Detection

```yaml
title: Brute Ratel C2 Detection
id: 7c9e1d84-8f34-4dae-bfd2-ebaebb6a1bfb
status: experimental
description: Detects suspicious activity related to configuring brute ratel c2 techniques in c2 frameworks context
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort: 443
    Initiated: "true"
  condition: selection
level: high
tags:
  - attack.t1059
  - attack.command_and_control
falsepositives:
  - Authorized penetration testing tools during scheduled assessments
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Brute Ratel C2 Detection | windows/network_connection | Sigma rule (high) |
| ATT&CK Coverage | MITRE ATT&CK | T1059 |

## Verification

- **Verify initialization**: `node scripts/agent.js verify --component listener`
- **Confirm badger callback**: `node scripts/agent.js verify --component badger`

## References

- MITRE ATT&CK: T1059
- Frameworks: MITRE ATT&CK
- Tools: brute-ratel, syscall, edr
