c2

C2 Architecture Analysis

Command and Control communication patterns drawn from public threat intelligence (MITRE ATT&CK, Mandiant APT reports, Equation Group disclosures), mapped to modern browser-based threat scenarios. Each pattern is paired with detection guidance so defenders can build rules against real, capturable traffic.

Containment: The C2 server and beacon bind loopback only, enforced by ContainmentGuard. Requires EXPLOIT_LAB_ACTIVE=1. See tools/lib/containment.py.

C2 Pattern Lineage

Documented nation-state C2 systems used multiple patterns, each optimized for different operational scenarios:

System	Technique	Detection Difficulty	References
ODDJOB	Mimicked Windows Update .cab requests	Very Hard - blends with legitimate OS traffic	Equation Group toolset analysis (NopSec), 2017 Equation Group disclosure (Wikipedia)
PeddleCheap	HTTP callbacks with Content-Type: image/jpeg	Medium - image responses without valid image headers	DanderSpritz framework docs, DoubleFeature deep dive (Check Point)
FlewAvenue	DNS queries + ICMP ping	Hard - DNS is ubiquitous, ICMP is often unmonitored	Equation Group toolset catalog (GitHub)
DoublePulsar	SMB TRANS2 SESSION_SETUP steganography	Hard - hides in legitimate protocol fields	Ring 0 shellcode analysis (zerosum0x0), SMB covert channel detection (SANS ISC), Detection script (Countercept/WithSecure)
StraitBizarre	Custom IPSEC-like protocol (FriezeRamp)	Medium - unusual protocol on standard ports	Equation Group toolset catalog (GitHub)
Bvp47	BPF-based kernel covert channel	Very Hard - operates below userspace visibility	Pangu Lab report (PDF), Technical details part II (Pangu Lab), The Register coverage

See also: MITRE ATT&CK T1071 -- Application Layer Protocol for the general technique taxonomy.

Components

File	Purpose
server.py	Live C2 server — Flask app with X25519 handshake, ChaCha20-Poly1305 channel, session tracking, task dispatch, operator REST API, WebSocket event stream. Loopback only.
crypto.py	Shared crypto primitives: X25519 ECDH, HKDF-SHA256 key derivation, ChaCha20-Poly1305 AEAD, replay protection, rekey policy, bucket-size padding
db.py	SQLite persistence layer — sessions, tasks, operators, audit log. WAL mode, per-thread connections, write lock.
auth.py	JWT HS256 operator auth, scrypt password hashing, RBAC (viewer/operator/admin)
events.py	In-process pub/sub broker — bounded subscriber queues, WebSocket fanout via /ws/events
modules.py	Ed25519 module signing registry: ModuleRegistry, SignedModule, verify_signed_module()
modules_src/	Example signed modules: netstat (TCP connections), ps (process list), uptime (load averages)
manage.py	CLI for operator management: init-admin, add-operator, list-operators, deactivate, issue-token, rotate-secret
beacon/beacon_client.py	Live beacon — X25519 handshake, encrypted check-in, 8 built-in commands + dynamic module dispatch, adaptive jitter, decoy check-ins
beacon/jitter.py	Jitter algorithms: uniform, gaussian, exponential, working-hours, burst-sleep, lognormal (correct human inter-arrival distribution), AdaptiveJitter (per-session log-normal re-fitting)
beacon/module_loader.py	Beacon-side dynamic loader — fetches signed modules from server, verifies Ed25519 sig, enforces capabilities via ContainmentGuard, caches in-session
beacon/beacon_analysis.py	Beacon pattern detection and classification for defenders (Zeek log ingestion, periodicity scoring)
architecture.md	Full C2 architecture analysis with detection guidance
profiles/	Traffic profile analysis (what mimicry looks like, how to detect it)
redirector/	Redirector infrastructure analysis

Quick Start

# Bootstrap admin account and start C2 server (loopback only)
python3 manage.py init-admin --db c2.db
python3 server.py --port 8443 --db c2.db

# In another terminal, start a beacon (lognormal jitter, 15% decoy check-ins)
python3 beacon/beacon_client.py --server http://127.0.0.1:8443 \
    --jitter lognormal --decoy-rate 0.15

# In another terminal, open the live dashboard (prompts for login)
python3 ../dashboard/dashboard_cli.py --c2 http://127.0.0.1:8443

# Operator API with JWT auth
TOKEN=$(curl -s -X POST http://127.0.0.1:8443/api/auth/login \
  -H 'Content-Type: application/json' \
  -d '{"username":"admin","password":"<pw>"}' | python3 -c "import sys,json; print(json.load(sys.stdin)['token'])")

curl -H "Authorization: Bearer $TOKEN" http://127.0.0.1:8443/api/sessions
curl -H "Authorization: Bearer $TOKEN" \
  -X POST http://127.0.0.1:8443/api/sessions/<id>/tasks \
  -H 'Content-Type: application/json' -d '{"command":"sysinfo"}'

Key Principle: Traffic Mimicry Beats Encryption

[EQ-REF] The Equation Group's most important C2 lesson: encrypted traffic on unusual ports is easy to flag. Traffic that looks like legitimate application traffic is far harder to detect - even if the content is also encrypted within that mimicry layer.

ODDJOB disguised C2 as Windows Update. PeddleCheap disguised callbacks as JPEG image loads. DoublePulsar hid commands inside standard SMB fields. The pattern is consistent: use the protocol the target environment already expects.

For browser-based threats targeting platforms like Databricks, the equivalent is mimicking the platform's own WebSocket protocol, analytics endpoints, or API calls.

Why Analytics HTTP for This Repo

Every C2 mimicry choice follows the same logic: hide in whatever traffic the target environment naturally produces. A protocol that doesn't belong in the environment is immediately suspicious regardless of how well it's encrypted or obfuscated.

Target environment	Expected traffic	C2 mimicry	System	Reference
Windows enterprise	Windows Update .cab requests	HTTP mimicking update checks	ODDJOB	NopSec analysis
File server	SMB file sharing	Commands in SMB TRANS2 reserved fields	DoublePulsar	zerosum0x0, SANS ISC
Linux server	DNS resolution, ICMP	Data in DNS subdomains + ICMP signaling	FlewAvenue	Toolset catalog
VPN gateway	IPSEC tunnels	Custom protocol resembling IPSEC	StraitBizarre	Toolset catalog
Linux kernel	Raw packets	BPF-level packet injection below userspace	Bvp47	Pangu Lab report
Browser / web app	Analytics HTTP, WebSocket	JSON API calls to analytics-style endpoints	This repo	--

A browser process or Streamlit app producing SMB TRANS2 packets or ICMP pings would be flagged immediately -- those protocols don't belong in that environment. But an HTTP POST to /v1/track with a JSON body resembling Segment or Mixpanel telemetry is indistinguishable from what hundreds of legitimate web apps produce every second.

This repo implements analytics HTTP as the primary channel (blends best in a web environment) and documents DNS exfiltration as a fallback channel (hardest to block -- almost nothing works without DNS, so it's rarely filtered even when HTTP egress is locked down).

Detection Approach

Each profile in this module documents:

1. What the mimicry looks like on the wire
2. What distinguishes it from legitimate traffic
3. Specific detection signatures (Suricata, Zeek, Sigma)
4. Behavioral indicators that survive mimicry