## 7 Comparison with Existing C2 Frameworks
It emphasizes stealth and evasion, employing highly obfuscated payloads designed to minimize detection by modern EDR solutions. Unlike many older frameworks that rely heavily on PowerShell, Havoc is built using modern programming languages and execution techniques, reducing its signature footprint. Its capabilities include process injection, shellcode execution, and in-memory payload execution, similar to other C2 frameworks but with a focus on improved detection evasion. Havoc's post-exploitation capabilities include standard techniques such as credential dumping, process manipulation, and lateral movement. However, being a newer framework, its ecosystem is less mature than that of Cobalt Strike or Sliver, potentially requiring operators to develop additional modules for more complex post-exploitation scenarios. Our proposal, C3 [4], provides built-in persistence, lateral movement, and evasion capabilities, along with customization options to facilitate adversary simulations. It can execute shellcode from other C2 frameworks and offers direct code execution on the OS. This enables the execution of arbitrary OS commands, such as _cmd_, without triggering detection alerts. Its web-based interface allows for operations from any OS. Lateral movement and credential dumping leverage native OS commands (e.g., _net use_, _schtasks/runas_), minimizing suspicious indicators from EDRs. Each compromised host communicates directly with the C2 server, a unique implementation offering several advantages for red team engagements. A comparison of these C2 frameworks reveals several key distinctions. Cobalt Strike remains a comprehensive and feature-rich commercial tool, particularly for advanced post-exploitation techniques such as Kerberos attacks and sophisticated lateral movement. However, its commercial nature and associated cost limit accessibility for independent researchers. Sliver and Mythic offer compelling open-source alternatives. Sliver excels in cross-platform support, while Mythic provides a highly customizable and modular approach. Havoc, a more recent framework, introduces novel approaches to stealth and evasion but currently lacks the extensive plugin and module ecosystem of established frameworks like Cobalt Strike and Sliver. C3's streamlined design and unique implementation, leveraging the native messaging API and reflective DLL loading, offer a distinct advantage for achieving stealth and resilience in post-exploitation scenarios, as demonstrated by its negligible detection rate against four popular EDR solutions in our tests. While Cobalt Strike offers a broader range of post-exploitation modules, C3 prioritizes direct command execution and a decentralized architecture, which provides significant operational security benefits. Furthermore, C3's open-source nature makes it readily accessible to all users. Ultimately, the selection of a C2 framework is contingent upon the specific operational requirements and the target environment. Cobalt Strike remains a strong choice for advanced red team operations demanding extensive post-exploitation capabilities. Sliver and Mythic provide flexible, open-source alternatives, each with distinct strengths. Havoc offers promising stealth capabilities for evading modern defenses. However, C3 presents a compelling alternative, particularly when stealth, resilience, and ease of use are paramount. Its unique approach, leveraging the native messaging API and decentralized architecture, offers significant advantages in minimizing detection and maximizing operational security. While each framework possesses inherent strengths and weaknesses, effective operators often employ multiple C2 solutions in concert to optimize their attack surface and enhance evasion. An additional crucial factor in evaluating C2 frameworks is their adaptability to modern defensive measures, including EDR solutions, antivirus engines, and network monitoring tools.