cognis-digital/c2detect

C2detect is a command line tool that helps security defenders spot signs of command and control infrastructure, the kind of remote channel attackers use to control compromised machines. Instead of watching live network traffic, it reads telemetry or observation records you already have, such as exported logs, and checks them against a built in database of twenty known C2 tools including Cobalt Strike, Sliver, Mythic, Havoc, and Brute Ratel. It flags things like beaconing patterns, unusual TLS certificate fingerprints, and staging URLs that match known signatures. The tool is strictly defensive. It makes no network connections and has no offensive capability of its own. It reads files, a directory of logs, or piped input, then reports findings ranked by severity so the biggest risks show up first. Installation is done with pip, and the basic command scans a file or folder in seconds. Results can be printed as a table in the terminal or exported as JSON, SARIF, HTML, or a small status badge, which makes it easy to plug into automated workflows. A ready made GitHub Action can scan telemetry during continuous integration, post findings as comments on pull requests, and fail a build when results at or above a chosen severity are found. Detection relies on a mix of signals: TLS fingerprint types such as JA4 and JARM, timing patterns like beacon interval and jitter, default user agent strings, and quirks in certificate details that match known C2 frameworks. Each finding receives a confidence score, and the minimum threshold shown can be tuned. An optional AI assisted mode can be switched on for extra analysis, though the tool works fully without it using rule based checks alone. The project also ships ports of its core detection logic in JavaScript, Go, and Rust, so teams working in different languages can apply the same rules. It suits security and blue team engineers who want a lightweight, self hostable way to check for C2 activity without standing up heavy security infrastructure or an active scanning setup.