<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: performing-c2-kill-chain-analysis
description: >-
  Analyze the full C2 kill chain from initial callback through persistence, lateral movement, and exfiltration to map adversary infrastructure and operational patterns.
domain: cybersecurity
subdomain: c2-frameworks
tags:
  - kill-chain
  - threat-intel
  - infrastructure
  - adversary-ops
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1071"]
  frameworks: ["MITRE ATT&CK", "Cyber Kill Chain"]
  tools: ["maltego", "shodan", "censys"]
---

# Performing C2 Kill Chain Analysis

## Overview

Analyze the full C2 kill chain from initial callback through persistence, lateral movement, and exfiltration to map adversary infrastructure and operational patterns.

## Prerequisites

| Tool / Requirement | Details |
|---|---|
| `maltego` | Security tooling |
| `shodan` | Security tooling |
| `censys` | Security tooling |
| Threat intelligence platforms, network logs, infrastructure scanning tools | Environment requirement |

## Quick Reference

```bash
# Quick start commands
node scripts/agent.js --help
node scripts/agent.js map --ioc c2_indicators.json
```

## Workflow

### Step 1: Map C2 Infrastructure

```bash
node scripts/agent.js map --ioc c2_indicators.json
```

### Step 2: Analyze Kill Chain Phases

```bash
node scripts/agent.js analyze --timeline incident_timeline.json
```

### Step 3: Correlate TTP Patterns

```bash
node scripts/agent.js correlate --ioc c2_indicators.json --framework mitre
```

## Detection

```yaml
title: C2 Kill Chain Analysis Detection
id: 0a8ce228-de2b-447b-ae3e-e0c42a9b7648
status: experimental
description: Detects suspicious activity related to performing c2 kill chain analysis techniques in c2 frameworks context
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort: 443
    Initiated: "true"
  condition: selection
level: high
tags:
  - attack.t1071
  - attack.command_and_control
falsepositives:
  - Authorized penetration testing tools during scheduled assessments
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| C2 Kill Chain Analysis Detection | windows/network_connection | Sigma rule (high) |
| ATT&CK Coverage | MITRE ATT&CK | T1071 |

## Verification

- **Verify infrastructure map**: `node scripts/agent.js map --ioc c2_indicators.json`
- **Confirm TTP correlation**: `node scripts/agent.js correlate --ioc c2_indicators.json --framework mitre`

## References

- MITRE ATT&CK: T1071
- Frameworks: MITRE ATT&CK, Cyber Kill Chain
- Tools: maltego, shodan, censys
