cognis-digital/c2detect
Scan TLS/network telemetry for known C2-framework fingerprints (Cobalt Strike, Sliver, Mythic, Havoc, Brute Ratel, …). Defensive triage only.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jul 4, 2026
- License
- None
Pinned Snippet
uses: cognis-digital/c2detect@cc494a3b889ebf58d5f2613a7a365d3755574f1e # whitepaper-v1tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| path | File or directory of observation/telemetry to scan. | no | . |
| format | Output format: table | json | sarif | html | badge. | no | sarif |
| fail-on | Fail the step if a match at/above this severity is found (critical|high|medium|low|info). Empty = never fail on severity. | no | high |
| threshold | Minimum confidence (0-100) to report a match. | no | 35 |
| output | Write the report to this file (in addition to stdout). | no | c2detect-report.sarif |
| comment-pr | If 'true' and run on a pull_request, post a findings comment via gh api. | no | true |
Outputs
| name | description |
|---|---|
| findings | Number of C2 indicators found. |
| badge | shields.io endpoint JSON for a status badge. |