AgentIndex icon
AgentIndex
ToolsMCP ServersHOTCategoriesTrendingNewBest ListsCompareGuides
Submit Tool
ToolsMCP ServersHOTCategoriesTrendingNewBest ListsCompare
Home/
Security & Safety/
c2detect
c2detect logo

c2detect

Active·★ 43·NOASSERTION·Updated 2026-09-13

C2DETECT is a C2 server fingerprinter designed for defensive C2-infrastructure triage. It scans observation records against a bundled signature database to identify beaconing, suspicious TLS fingerprints, and staging URIs without requiring network connectivity or active capabilities.

#C2 Server Fingerprinting#Threat Detection#Offensive Security#Defensive Security#TLS Fingerprinting#Behavioral Analysis
© 2026 AgentIndex.app|Built by a 10-year iOS Developer.
Best by use caseAboutContactAdvertisePrivacy PolicyTerms of UseQYSGitHubBuy me a coffee ☕

Browse by Category

MCP ServersCode AssistantWorkflow AutomationRAG / Knowledge BaseMulti-AgentBrowser AutomationLLM InfraDev ToolingObservability

Not affiliated with Anthropic, OpenAI or Microsoft.

Guides
#CI/CD Integration
#Python
$ Install
$ pip install cognis-c2detect
↗ Visit site★ GitHub
01

Features

01Fingerprints 20 C2 families including Cobalt Strike, Sliver, and Mythic.
02Utilizes TLS (JA4, JA3, JARM) and behavioral indicators like beacon interval and URI regexes.
03Provides output in multiple formats: table, JSON, SARIF, HTML report, and shields.io badge.
04Integrates as a reusable GitHub Action for CI/CD, enabling automated scanning and PR commenting.
05Strictly defensive, performing detection from observations only without active network interaction.
02

Compatibility

Python
Runtime
Verified via docs
Linux
OS
Verified via docs
macOS
OS
Verified via docs
Windows
OS
Verified via docs
Docker
Container
Verified via docs
GitHub Actions
CI/CD
Verified via docs
03

Quick start

1
$ pip install cognis-c2detect
04

Use cases

↳Scan observation files, telemetry text, or directories to identify C2 server signals.
↳Match explicit C2 indicators directly from the command line for quick checks.
↳Gate CI/CD pipelines by failing builds based on detected C2 severity.
↳Generate machine-readable reports (JSON, SARIF) for integration with other security tools.
↳Triage and analyze defensive C2 infrastructure by processing logs and observation records.
05

Alternatives

⚡Top VS:
VSguardana★251→VSrsigma★172→VSWonderSuite-Ai-Bug-Bounty★51→

Comments

Log in to leave a comment

No comments yet. Be the first!

On this page
01Features02Compatibility03Quick start04Use cases05Alternatives
VS
ida-pro-mcp
★13.1k
→
guardana logo
guardana★ 251
Open-source AI security verification for model artifacts, live endpoints, MCP servers, and recorded agent traces. Reproducible evidence for release decisions.
VSCompare→
rsigma logo
rsigma★ 172
A complete Sigma detection engineering toolkit: parser, linter, evaluator, correlation engine, conversion framework, streaming daemon, MCP and LSP servers :crab:
VSCompare→
WonderSuite-Ai-Bug-Bounty logo
WonderSuite-Ai-Bug-Bounty★ 51
AI-Powered Offensive Security Research Engine - desktop-native security testing platform with native MCP integration. 90 tools, MITM proxy, stealth browser, autonomous AI agent. Built on Tauri + Rust + React.
VSCompare→
ida-pro-mcp logo
ida-pro-mcp★ 13.1k
AI-powered reverse engineering assistant that bridges IDA Pro with language models through MCP.
VSCompare→
agent-governance-toolkit logo
agent-governance-toolkit★ 6.5k
AI Agent Governance Toolkit — Policy enforcement, zero-trust identity, execution sandboxing, and reliability engineering for autonomous AI agents. Covers 10/10 OWASP Agentic Top 10.
VSCompare→
CyberStrike logo
CyberStrike★ 3.2k
Open-source AI-augmented offensive security harness. 13+ autonomous agents, 150+ LLM providers, 5,300+ models, 7,600+ Ed25519-signed attack skills, 56+ built-in tools, 176+ MCP tools. MITRE ATT&CK, OWASP WSTG, CIS Benchmarks. Post-exploit: Linux/Windows/macOS/AWS/Azure/K8s/CI-CD. Web UI + Cloudflare Tunnel. Your AI red team.
VSCompare→
AiSOC logo
AiSOC★ 2.8k
Open-source AI Security Operations Center: alert fusion, LLM-agent triage, MITRE ATT&CK investigation, and a replayable decision ledger for every agent step. Self-hostable, runs with no API keys, MIT licensed. Ships an MCP server for Claude, Cursor and Continue.
VSCompare→
sleepless-agent logo
sleepless-agent★ 834
🤖 24/7 AI agent that maximizes Claude Code Pro usage via Slack. Auto-processes tasks, manages isolated workspaces, creates Git commits/PRs, and optimizes day/night usage thresholds.
VSCompare→
See all alternatives →
cognis-digital /
c2detect
↗

C2 server fingerprinter — Cobalt Strike, Sliver, Mythic, Havoc, Brute Ratel

43
Last commit1mo ago
StatusActive
CategorySecurity & Safety
Links
Documentation↗Discussion↗Issues↗Releases↗
Cloud Infrastructure
Ad

Deploy on DigitalOcean

Host your MCP servers, Docker containers, and AI agents with $200 free credit over 60 days.

Claim $200 Free Credit