framework-mimics

C2 Framework Mimic Profiles

Traffic profiles for seven post-2022 C2 frameworks. Each profile documents the framework's observed beacon characteristics, transport headers, encoding, and detection signatures — for defensive analysis and sensor tuning.

See docs/analysis/c2-framework-market-2026.md for the framework landscape analysis.

Profiles

File	Framework	Transport	Interval	Primary Operators
adaptixc2.yaml	AdaptixC2	HTTPS	60s	Nation-state (Unit 42, Apr 2026)
emp3r0r.yaml	emp3r0r	TLS custom / HTTP	30s	Linux server compromise chains
apex.yaml	APEX	HTTPS (Azure API)	360s	Cloud-native post-exploitation
mythic.yaml	Mythic	HTTPS	60s	Red teams; various APT groups
havoc.yaml	Havoc C2	HTTPS + SMB	30s	Red teams; limited TA adoption
brute_ratel.yaml	BruteRatel C4	HTTPS	45s	Ransomware affiliates; APT29 (suspected)
nighthawk.yaml	NightHawk	HTTPS / HTTP2 / QUIC	120s	Nation-state; tier-1 red teams

Profile Format

Each YAML file includes:

• Attribution header — source, first-seen date, known campaigns
• beacon — interval, jitter, user-agent, URI, method
• headers — complete header set matching the framework's traffic fingerprint
• body — encoding and size bounds
• sleep_mask / process_inject — capability flags
• detection_notes — distinguishing characteristics vs. legitimate traffic; MITRE ATT&CK technique references

Usage

These profiles are input to the profile loader and can be used to:

• Generate synthetic beacon traffic for sensor testing
• Tune IDS/IPS rules against known framework fingerprints
• Validate EDR telemetry coverage for each framework

from tools.c2.profiles.profile_loader import load_profile
profile = load_profile("tools/c2/profiles/framework-mimics/nighthawk.yaml")

Containment

Requires EXPLOIT_LAB_ACTIVE=1. Profile loader enforces containment before generating any network traffic.