ATT&CK C2 and Post-Exploitation Frameworks Software Hub: Catalogue and Detection of Red Team Tooling

Commercial and open source red team frameworks give attackers mature command and control, credential theft and lateral movement without writing a line of malware. This hub catalogues the 23 MITRE ATT&CK Enterprise v20 software entries that NHI Mgmt Group groups as command and control (C2) and post-exploitation frameworks, from Cobalt Strike, Sliver and Havoc to Empire, CrackMapExec and the cloud and Kubernetes frameworks Pacu and Peirates. It shows the behaviours the family shares, computed from the ATT&CK v20 technique relationships, and turns them into detection and control priorities. It is for SOC analysts, detection engineers and red team leads who need to tell authorised testing from an intrusion. Deep detection for individual frameworks lives in the Cobalt Strike Abuse Detection Guide and the Sliver, Havoc and Brute Ratel C2 Frameworks Detection Guide; this page is the catalogue view.

Key takeaways

• Mostly tools, widely shared: 19 of the 23 entries are ATT&CK tools rather than malware, and ATT&CK v20 links Cobalt Strike alone to 30 groups.
• Discovery dominates, credentials follow: after T1059 Command and Scripting Interpreter, the most common mapped techniques are T1087 Account Discovery, T1016 System Network Configuration Discovery and T1071 Application Layer Protocol, with T1003 OS Credential Dumping on 11 of the 23 members.
• Detect the behaviour, not the brand: frameworks are rebuilt, renamed and cracked, so durable detection targets injection, credential access and beaconing patterns rather than a single signature.
• Cloud and cluster frameworks run on stolen machine credentials: Pacu works from AWS access keys and Peirates automates theft of Kubernetes service account tokens, so non-human identity controls are C2 controls.
• Authorised use needs a paper trail: a register of approved red team infrastructure, implants and windows is what lets the SOC treat every other sighting as hostile.

What this category covers and why it matters

ATT&CK does not have a "framework" software type. This hub is an NHI Mgmt Group grouping of v20 entries whose main purpose is post-exploitation control: an operator console, implants or agents, and modules for discovery, credential access and lateral movement. It includes full C2 platforms (Cobalt Strike, Sliver, Havoc, Mythic, Covenant, Brute Ratel C4, Empire, PoshC2, SILENTTRINITY, Koadic, Pupy), open source remote administration tools used the same way (QuasarRAT, AsyncRAT), post-exploitation utilities (PowerSploit, CrackMapExec, LaZagne, MailSniper), injection tools (sqlmap, Havij), cloud and container frameworks (Pacu, Peirates) and two framework-style malware families (InvisiMole, IceApple).

The category matters because it lowers the cost of a capable intrusion. ATT&CK describes Cobalt Strike as commercial adversary simulation software whose post-exploitation capabilities cover the full range of ATT&CK tactics, and records that a cracked version of Brute Ratel C4 leaked in criminal forums in September 2022. ATT&CK also notes that Empire was one of five tools singled out in a joint government report on public hacking tools widely used by adversaries. The same tooling your red team uses will appear in real incidents, often with default profiles left in place.

Common behaviours across the family

The table counts how many hub members ATT&CK v20 maps to each technique, with sub-techniques rolled up to their parent. Techniques near the top are the best value for detection that works across frameworks.

• Execution through interpreters: PowerShell and other interpreters (T1059) remain the common execution path, so PowerShell script block logging and constrained language mode still pay off.
• Discovery in bulk: account, network configuration, file and process discovery appear across most members. Volume and breadth over a short window is the signal.
• Credential access built in: T1003 OS Credential Dumping, T1552 Unsecured Credentials and T1555 Credentials from Password Stores are mapped to many members, which is why a framework sighting should trigger credential review.
• Injection and token manipulation: T1055 Process Injection and T1134 Access Token Manipulation let implants run inside trusted processes and act as other users.
• Encrypted web C2: T1071 Application Layer Protocol and T1573 Encrypted Channel, often with T1090 Proxy, make beacon timing and destination rarity more useful than content inspection. See the Beaconing and C2 Detection Guide.

Real cases

• SolarWinds Compromise: ATT&CK v20 links Cobalt Strike to the SolarWinds Compromise campaign, where the attackers moved from the backdoored Orion update to on-premises administrative access and then to forged SAML tokens and abused application identities. See the SolarWinds Supply Chain Compromise breach analysis and the APT29 (Midnight Blizzard) Threat Actor Profile, a group ATT&CK also links to Sliver.
• Covenant and HAFNIUM: ATT&CK states that Covenant, a .NET C2 framework designed for penetration testing, has been used by HAFNIUM during operations. See the Silk Typhoon Threat Actor Profile Guide.
• Cracked commercial tooling: ATT&CK records the September 2022 leak of a cracked Brute Ratel C4 build, a framework it describes as designed to avoid detection by EDR and antivirus. Once a cracked build circulates, the licence controls on the commercial product no longer limit who runs it.
• Kubernetes token theft: the Peirates project describes itself as a Kubernetes penetration testing tool that automates known techniques to steal and collect service account tokens and secrets. ATT&CK links it to TeamTNT.
• AWS key abuse: the Pacu project describes an AWS exploitation framework for authorised testing whose modules run from an access key ID and secret access key, covering privilege escalation and backdooring IAM users.

Detection themes

The command and control tactic view is covered in the ATT&CK Command and Control Tactic guide, and C2 over trusted cloud services in the Cloud Services Abuse for C2 Guide.

Where identity fits

Every framework in this hub turns credentials into reach. CrackMapExec and LaZagne harvest passwords and hashes, Cobalt Strike and Covenant pass them on, and Pacu and Peirates operate entirely through machine credentials. That makes non-human identity hygiene a direct C2 control: short-lived cloud credentials instead of long-lived access keys, bound and audience-scoped Kubernetes service account tokens, least privilege role bindings, and alerts when a machine identity starts enumerating. See the AWS Access Keys Security Guide and the Kubernetes Service Account Token Guide.

Separating authorised testing from intrusion

1. Keep a red team register: record approved frameworks, implant hashes or watermarks where available, C2 domains and IP addresses, operators and test windows, and share it with the SOC before each engagement.
2. Alert on everything, then suppress narrowly: detections fire for all frameworks; suppression applies only to register entries during their window.
3. Restrict tool use internally: use application control to block offensive frameworks on systems outside the red team's estate, starting in audit mode on a pilot group and keeping a rollback policy.
4. Test the detections: ask the red team to run each framework's default and customised profiles against a pilot ring and record which analytics fired.
5. Close the loop: after each engagement, add missed behaviours to the detection backlog and retire register entries.

Measuring coverage

• Share of the top 15 hub techniques with at least one tested analytic.
• Percentage of red team engagements detected before the agreed reveal, by framework.
• Mean time from first beacon to containment in exercises and real incidents.
• Number of long-lived cloud access keys and non-expiring Kubernetes tokens remaining.
• Endpoints with PowerShell script block logging and process creation command line logging on.

Framework mapping

Common failure patterns

• Blanket allowlisting of the red team: suppressing all Cobalt Strike or Sliver alerts because "it is probably the testers" rather than checking the register.
• Signature-only detection: relying on default profiles and known hashes that a cracked or customised build no longer matches.
• Ignoring the cloud frameworks: covering Windows implants well while machine identities in AWS and Kubernetes can enumerate without alerts.
• Treating a framework sighting as a single host problem: cleaning the host without reviewing the credentials the framework harvested.
• Missing egress control: letting servers make direct outbound connections, which removes the proxy logs beaconing analytics need.

Complete catalogue: C2 and post-exploitation frameworks in ATT&CK v20

All 23 entries (4 malware, 19 tools), sorted by name. Groups are those ATT&CK v20 links to the software; distinctive techniques are the member's mapped techniques that are least common across this hub. Each ID links to its ATT&CK page.

Related software hubs: ATT&CK Espionage Backdoors and Implants Software Hub and ATT&CK Rootkits and Bootkits Software Hub.

Practitioner checklist

• Map the top hub techniques to your analytics and test each one with a red team run.
• Turn on process creation command lines, Sysmon or equivalent EDR telemetry and PowerShell script block logging.
• Force server egress through proxies and analyse beacon timing and destination rarity.
• Keep a red team register and suppress only listed infrastructure during agreed windows.
• Block offensive frameworks with application control outside approved testing systems.
• Replace long-lived AWS access keys and legacy Kubernetes tokens with short-lived credentials.
• Alert on enumeration bursts by machine identities in cloud and Kubernetes audit logs.
• After any framework sighting, rotate credentials reachable from the affected hosts.

Standards and references

• MITRE ATT&CK: Cobalt Strike (S0154)
• MITRE ATT&CK: Sliver (S0633)
• MITRE ATT&CK: Brute Ratel C4 (S1063)
• MITRE ATT&CK: Command and Control tactic (TA0011)
• Rhino Security Labs: Pacu project documentation
• InGuardians: Peirates project documentation
• NCSC: SVR cyber actors adapt tactics for initial cloud access
• NIST: SP 800-53 Rev 5 Security and Privacy Controls

Related NHI Mgmt Group resources: Command and Control (C2) Guide · Cobalt Strike Abuse Detection Guide · Sliver, Havoc and Brute Ratel C2 Frameworks Detection Guide · Beaconing and C2 Detection Guide