Real Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis.

Berry Sentinel v5.0 — Advanced behavioral C2 and reverse shell detector for Linux/Windows/Unix systems. Features real-time connection analysis, heuristic scoring, C2 framework signature detection, beacon interval analysis, and an interactive curses-based TUI with process kill engine.

Scrapes a list of Payload Domains, IOC's & C2 IPs from from various feeds for easy blacklisting.

C2 Framework Fingerprinter: identifies Cobalt Strike, Metasploit, Sliver, Havoc, Covenant, Brute Ratel from PCAP traffic using beacon analysis, URI patterns, JA3, and HTTP headers

AI-powered network packet analyzer: detects C2, exfiltration, and lateral movement from pcap or tcpdump output.

A Wireshark-based network traffic analysis simulating a live SOC incident at Vendmo Tech. Detects C2 beaconing, data exfiltration & port scanning across a 2.3GB PCAP. Includes 8 findings, 10 IOCs, MITRE ATT&CK v14 mapping & attack timeline. Blue Team / SOC portfolio project.

Outbound network monitor to detect beaconing and command-and-control-like behavior on Linux hosts.

🛡️ Monitor outbound TCP connections on Linux with C2 Hunter, a lightweight tool that reveals active sessions and enhances your security posture.

Network traffic analysis using Wireshark to identify suspicious HTTP POST-based Command-and-Control (C2) communication and extract Indicators of Compromise (IOCs).

Autonomous Vigilance Engine for Reconnaissance Yield

Lab 03 - Malware Traffic Analysis | Wireshark Packet Capture | TCP+UDP Scan Patterns | C2 Simulation | 1066 Packets Analyzed | SOC Lab

Detect C2 beacons in network traffic using Floquet spectral analysis from quantum chaos theory. Fast, 274KB Zig binary. Reads pcap, live capture, or OpenTelemetry JSONL.

eBPF-based monitor for detecting suspicious activity during Docker image builds

menu bar malware monitor. detects and kills blockchain C2 backdoor processes, with a live web dashboard

Detects C2 connections in real time by analyzing process behavior without relying on signature databases or IP blacklists.