<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# performing-c2-infrastructure-hunting — API Reference

## Agent Script

| Command | Description |
|---------|-------------|
| `scan --target <path>` | Scan target for C2 infrastructure indicators. |
| `fingerprint --target <path>` | Fingerprint server using JARM and certificate analysis. |
| `correlate --target <path>` | Correlate IOCs across threat intelligence sources. |

## Usage Examples

```bash
# Scan target for C2 infrastructure indicators.
node scripts/agent.js scan --target ./sample

# Fingerprint server using JARM and certificate analysis.
node scripts/agent.js fingerprint --target ./sample

# Correlate IOCs across threat intelligence sources.
node scripts/agent.js correlate --target ./sample
```

## Output Format

All commands return JSON with the following structure:

```json
{
  "action": "<command>",
  "result": {
    "action": "<command>",
    "status": "complete",
    "domain": "<domain>",
    "technique": "performing-c2-infrastructure-hunting"
  }
}
```
