Tooluck logoTooluck
SKILL.md

offensive-c2-frameworks

Agent skill fromSnailSploit/Claude-Red

Command and Control framework deployment, configuration, and operational tradecraft for red team engagements. Covers Cobalt Strike (malleable C2 profiles, Beacon types HTTP/HTTPS/DNS/SMB, Beacon Object Files for in-memory execution, sleep and jitter tuning, named pipe pivoting), Sliver (implant generation across mTLS/WireGuard/DNS transport, operator multiplayer mode, armory extensions), Mythic (agent ecosystem with Apollo/Poseidon/Medusa, C2 profile configuration, translation containers), Havoc (Demon agent with sleep obfuscation via Ekko/Zilean, indirect syscalls, dotnet inline execution), Metasploit (msfvenom payload generation, multi/handler staging, Meterpreter post-exploitation modules), redirector architecture using Apache mod_rewrite and Nginx, domain fronting through CDN providers, DNS-based C2 for restrictive network egress, and TLS certificate management for infrastructure OPSEC. Tools: Cobalt Strike, Sliver, Mythic, Havoc, Metasploit Framework. Aligns to MITRE ATT&CK T1071

How to install offensive-c2-frameworks

install offensive-c2-frameworks
# install the Claude-Red pack with the skills CLI
npx skills add SnailSploit/Claude-Red

# or add only this skill to Claude Code: copy the folder

Skills/forensics/offensive-c2-frameworks/

# into

~/.claude/skills/offensive-c2-frameworks/ (all projects)

.claude/skills/offensive-c2-frameworks/ (one project)

Skills/forensics/offensive-c2-frameworks/SKILL.md

MITFull file
1# Offensive C2 Frameworks
2
3Command and Control is the backbone of any sustained red team engagement. Your C2 framework manages implant communication, task distribution, post-exploitation, and lateral movement coordination. Selecting and configuring the right framework -- and layering proper infrastructure around it -- determines whether your operation survives the first 48 hours or burns within minutes of initial access.
4
5This skill covers the major C2 frameworks you encounter in professional red teaming, their configuration for operational security, the infrastructure patterns that protect your backend servers, and the tradecraft decisions that separate detectable operations from resilient ones. You are expected to understand not just how to deploy these tools, but why specific configuration choices matter against modern EDR and network monitoring.
6
7## Quick Workflow
8
91. Define your engagement's network constraints -- identify allowed egress protocols, proxy requirements, and monitoring posture.
102. Select a primary C2 framework and transport based on target environment restrictions.
113. Build redirector infrastructure between your implants and your team server -- never expose the team server directly.
124. Configure communication profiles to mimic legitimate traffic patterns for the target organization.
135. Generate implants with appropriate sleep intervals, jitter, and kill dates.
146. Establish primary and fallback C2 channels using different transports and infrastructure.
15…

Excerpt shown under the repository's MIT license.

More skills in Claude-Red

Keep exploring

Similar skill repositories

thedotmack /

claude-mem
116k

Persistent Context Across Sessions for Every Agent – Captures everything your agent does during sessions, compresses it with AI, and injects relevant context back into future sessions. Works with Claude Code, OpenClaw, Codex, Gemini, Hermes, Copilot, OpenCode + More

CCCXGHGM+135 skills

Newsletter

Join the Community

Subscribe to our newsletter for the latest news and updates