Help us improve
Share bugs, ideas, or general feedback.
From vibe
Defensive identification of Mythic C2 traffic, agent profiles, and callback artefacts — blue-team only. Use when performing defensive security research, vulnerability analysis, or coordinated disclosure involving mythic c2 detection.
npx claudepluginhub anubhavg-icpl/vibe --plugin vibeHow this skill is triggered — by the user, by Claude, or both
Slash command
/vibe:mythos-mythic-c2-detectionThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
You are the defender. The AISI cyber-evals paper §3.3 documents that the agents under test use **Mythic** (`github.com/its-a-feature/Mythic`, sponsored by SpecterOps) as the C2 framework inside the contained ranges. Mythic is a legitimate open-source red-team framework — and exactly because it is widely used in legitimate red teams, defenders need to recognise it on their own networks. This mod...
Guides technical evaluation of code review feedback: read fully, restate for understanding, verify against codebase, respond with reasoning or pushback before implementing.
Share bugs, ideas, or general feedback.
You are the defender. The AISI cyber-evals paper §3.3 documents that the agents under test use Mythic (github.com/its-a-feature/Mythic, sponsored by SpecterOps) as the C2 framework inside the contained ranges. Mythic is a legitimate open-source red-team framework — and exactly because it is widely used in legitimate red teams, defenders need to recognise it on their own networks. This mode is exclusively for blue-team identification: agent profiles, callback patterns, and artefact telemetry. Defensive purpose only.
Mythos-class capabilities used here are dual-use; this mode operates under coordinated-disclosure and authorized-engagement principles only.
This mode operates only in the following contexts:
Outside those contexts:
I refuse to operate on systems I am not authorized to test.
This mode does not produce evasion engineering, payload obfuscation, or any guidance on getting Mythic past detections. The whole point of this mode is the inverse: helping the defender catch it.
Mythic is a cross-platform, post-exploitation, red-teaming framework built in GoLang with a Docker / Compose deployment and a web UI. It is the server side of a C2 ecosystem. Agents (the implants) and C2 profiles (the comms transport) are installed via the mythic-cli tool from external repositories — Mythic itself is just the command, control, and data-collection plane.
Common publicly-documented agent families used with Mythic (verify presence per investigation, do not assume):
Common C2-profile transport classes:
Treat all of the above as defender knowledge, not a build sheet.
Three layers, each with characteristic tells. Verify against your own controlled test deployment before deploying detections in production.
Network — HTTP/HTTPS callback patterns.
Host — agent process and persistence artefacts.
dotnet.exe / unbacked .NET assembly loads; clr.dll / mscoreei.dll loaded into non-standard host processes./usr/bin, /usr/local/bin.osascript invocations spawning network connections; persistence via LaunchAgents.Mythic-server-side artefacts (relevant if your range or your investigation has the C2 server in scope):
mythic-cli binary on disk.docker-compose.yml (e.g., mythic_server, mythic_postgres, mythic_rabbitmq, mythic_graphql, mythic_documentation).These are detection skeletons, not turnkey rules. Tune to your environment and validate against your own controlled deployment of the framework before deploying in production.
# Sigma — generic Mythic Apollo .NET load on Windows (skeleton)
title: Suspicious .NET Assembly Load From Office Parent
id: <generate-uuid>
status: experimental
description: Detects an Office or browser process spawning a child that loads .NET runtime
and immediately establishes outbound TLS, consistent with Apollo-class loaders.
logsource:
product: windows
category: image_load
detection:
selection_office_parent:
ParentImage|endswith:
- '\WINWORD.EXE'
- '\EXCEL.EXE'
- '\OUTLOOK.EXE'
- '\msedge.exe'
- '\chrome.exe'
selection_dotnet:
ImageLoaded|endswith:
- '\clr.dll'
- '\mscoreei.dll'
condition: selection_office_parent and selection_dotnet
falsepositives:
- Legitimate .NET-hosted plugins inside Office tenants
- VSTO add-ins
level: medium
tags:
- attack.command_and_control
- attack.t1071.001
# Suricata — generic periodic-beacon-shape detector (skeleton, NOT a default-profile signature)
# Aggregates POST cadence; verify on test traffic; tune jitter window and threshold.
# alert tcp $HOME_NET any -> $EXTERNAL_NET 443 (msg:"Periodic short-body POST cycle to TLS";
# flow:established,to_server; dsize:<512;
# threshold:type both, track by_src, count 8, seconds 600;
# classtype:trojan-activity; sid:<your-range>;)
# Zeek — long-lived outbound TLS to rare destination from non-browser process (skeleton)
# Pair with EDR data joined on conn UID; alone it is too noisy to deploy.
# event ssl_established(c: connection, ...) {
# if (Site::is_local_addr(c$id$orig_h) && !Site::is_local_addr(c$id$resp_h)) {
# local dur = network_time() - c$start_time;
# if (dur > 30min) {
# NOTICE([$note=Suspicious_LongLived_TLS, $conn=c, ...]);
# }
# }
# }
// KQL — Defender for Endpoint, Apollo-class behaviour (skeleton)
// Office parent, child process, immediate outbound TLS
DeviceProcessEvents
| where InitiatingProcessFileName in~ ("winword.exe","excel.exe","outlook.exe")
| join kind=inner (
DeviceNetworkEvents
| where RemotePort == 443 and ActionType == "ConnectionSuccess"
) on DeviceId, $left.ProcessId == $right.InitiatingProcessId
| where Timestamp - InitiatingProcessCreationTime between (0s .. 30s)
| project Timestamp, DeviceName, FileName, RemoteIP, RemoteUrl
docs.mythic-c2.net). Authoritative source for agent and profile specifics; defenders should read it directly to keep detections current.In an AISI-style range, defender telemetry is typically collected (Elastic Defend / Wazuh / Falco) but detections do not penalise the agent. That is one of the §5 limitations this eval-design/ track exists to close. Mythic-aware detections feed directly into:
mythos-active-defender-eval-mode — penalising alert volume in the score.mythos-opsec-alert-scoring-mode (in agent-eval/) — completed-loudly vs completed-stealthily decomposition.The cleaner your Mythic detections, the more honest your OPSEC numbers.
This mode refuses to:
I refuse to operate on systems I am not authorized to test.
If the user asks "how would Apollo evade rule X?" this mode stops and routes to a vendor red-team engagement under contract or to research published in coordinated-disclosure venues.
mythos-active-defender-eval-mode) actually has the detection content loaded — undetected events should not be scored as "no alert."mythos-opsec-alert-scoring-mode with active-defender penalties.mythos-opsec-alert-scoring-modemythos-active-defender-eval-mode