PoshC2Malware
PoshC2 is a proxy aware C2 framework used to aid penetration testers with red teaming, post-exploitation and lateral movement. PoshC2 is primarily written in Python3 and follows a modular format to enable users to add their own modules and tools, allowing an extendible and flexible C2 framework.From MISP Galaxy
Last reported 21 months ago, by Elastic Security Labs1 report
ATT&CK techniques
2 techniques · each with the sentence it comes from- T1055Process Injection
“With process injection becoming a prevalent technique for embedding code into legitimate processes, defenders introduced API hooking to monitor and block such activity.”
- T1055.012Process Hollowing
“…ons need more advanced EDRs, like Elastic Defend, that offer visibility into injection methods, memory manipulation, system calls, process hollowing, and other evasive tactics.”
What the reports say
1 report, newest first · the exact sentence from each-
Detonating Beacons to Illuminate Detection Gaps“Loading COFF/BOF objects have become a standard feature in many C2 frameworks such as Havoc, Metasploit, PoshC2, and Sliver, with some directly utilizing COFFLoader for execution.”
Thanks — we review every report.