C2 Frameworks#
InfraGuard supports the following C2 frameworks. Each requires a profile file that InfraGuard parses to validate inbound beacon traffic.
| Framework | profile_type | Profile format |
|---|---|---|
| Cobalt Strike | cobalt_strike | Malleable C2 .profile |
| Mythic | mythic | HTTPX agent JSON |
| Brute Ratel C4 | brute_ratel | Listener config JSON |
| Sliver | sliver | HTTP config YAML |
| Havoc | havoc | Listener YAML |
| Nighthawk | nighthawk | Listener JSON |
| PoshC2 | poshc2 | Config YAML |