c2
Framework-agnostic C2 orchestration — listener types, implant modes, redirector architecture, malleable profiles, jitter strategy, OPSEC guidance.
Best for Red team operatorsWorks with GitHubHigh risk
⌘source
- author
@PurpleAILAB- language
- Python
★2.1kstars
366forks
Apr 18, 2026
✦overview.md
Key Features
- ·Framework-agnostic C2 orchestration
- ·Deploys C2 servers as separate containers on sandbox-net
- ·Kali sandbox contains only C2 clients
- ·Selectable via Docker Compose profiles
- ·Includes listener types and implant modes
- ·Covers redirector architecture and OPSEC guidance
Use Cases
- →Setting up persistent, covert communication channels for post-exploitation
- →Minimizing detection of command and control infrastructure
- →Ensuring operational resilience through redirector architecture
- →Orchestrating C2 frameworks like Sliver or Havoc in isolated containers
Best for
- ✓Red team operators
- ✓Security testing environments
- ✓Controlled sandbox deployments
Not ideal for
- !Production environments
- !General development tasks
- !Non-security-related operations
FAQs
name
c2
description
Framework-agnostic C2 orchestration — listener types, implant modes, redirector architecture, malleable profiles, jitter strategy, OPSEC guidance.
allowed-tools:Bash Read
metadata:{"subdomain":"command-and-control","when_to_use":"C2, command and control, implant, beacon, listener, redirector, teamserver, payload delivery","tags":"c2, implant, beacon, listener, redirector, payload, orchestration","mitre_attack":"T1071, T1573, T1090, T1105, T1572"}
Command & Control (C2) Knowledge Base
C2 infrastructure enables persistent, covert communication between the operator and implants deployed on target systems. Proper C2 setup minimizes detection, ensures operational resilience through redirectors, and provides the foundation for all post-exploitation activity.
Decepticon C2 Architecture
C2 servers run as separate containers on
sandbox-net, selectable via docker compose profiles. The Kali sandbox has C2 clients only — servers are never co-located with the attack box.
Framework Container Profile Client in Sandbox Sliver c2-sliverc2-sliver(default in.env)sliver-clientHavoc c2-havocc2-havoc(future)havoc-client(future)Default:
COMPOSE_PROFILES=c2-sliverin.env→docker compose up -dstarts Sliver. Swap: changeCOMPOSE_PROFILESvalue to use a different C2 framework. For framework-specific setup, consult the dedicated skill:c2-sliver,c2-havoc, etc.
MITRE ATT&CK Mapping
| Technique ID | Name | C2 Relevance |
|---|
$install
1-click copynpx skills add PurpleAILAB/Decepticon --skill c2Safety assessment
★
Clarity score
How clear and easy to understand the SKILL.md instructions are, rated from 1 to 5.
3/ 5
goodMostly clear, but there are still a few confusing or poorly structured parts.
◎
Actionability score
How directly an agent can act on the SKILL.md instructions, rated from 1 to 5.
2/ 5
lowSome hints are present, but an agent still has to guess many steps.