C2 techniques

← maldev README · docs/index

The c2/* package tree is the implant's outbound communication layer plus the operator's listener side. Six sub-packages compose into a complete reverse-shell / staging / multi-session stack:

flowchart LR
    subgraph implant [Implant side]
        S[c2/shell<br>reverse shell]
        M[c2/meterpreter<br>MSF stager]
    end
    subgraph wire [Wire]
        T[c2/transport<br>TCP / TLS / uTLS]
        NP[c2/transport/namedpipe<br>SMB pipes]
        Cert[c2/cert<br>mTLS certs + pinning]
        T -.uses.-> Cert
    end
    subgraph operator [Operator side]
        MC[c2/multicat<br>multi-session listener]
    end
    S --> T
    S --> NP
    M --> T
    T --> MC
    NP --> MC

Packages

Quick decision tree

MITRE ATT&CK

See also

• Operator path: build a reliable shell
• Detection eng path: C2 telemetry
• evasion — apply patches before the shell connects.
• useragent — pair with HTTP transports for realistic User-Agent headers.
• inject — stage execution surface for c2/meterpreter.