## 7 Comparison with Existing C2 Frameworks  
Command and control frameworks are essential tools for both red team operations and malicious actors, enabling remote access, persistence, and post-exploitation activities. Among the most widely used C2 frameworks are Cobalt Strike, Sliver, Mythic, and Havoc. This section compares C3 with these prominent frameworks, highlighting its distinguishing advantages. Cobalt Strike [5] is a widely recognized and extensively used commercial C2 framework, frequently observed in both red teaming exercises and real-world threat actor activity. Its comprehensive suite of tools facilitates reconnaissance, privilege escalation, and lateral movement. The Beacon payload, Cobalt Strike's core component, enables operators to execute commands, inject shellcode, perform keylogging, and interact with the file system. It supports diverse command execution methods, including PowerShell, WMI, and native Windows API calls. Cobalt Strike incorporates various obfuscation and evasion techniques, such as in-memory execution, payload encryption, and process injection, aimed at minimizing detection. Seamless integration with Metasploit allows for leveraging exploits from a comprehensive offensive security toolkit. For post-exploitation, Cobalt Strike offers capabilities for persistence, credential harvesting, and lateral movement, including built-in tools for Kerberos ticket attacks (Pass-the-Ticket, Golden Ticket), password dumping via Mimikatz, and DCSync attacks. Robust pivoting techniques, including Secure Shell (SSH) tunneling and named pipe relays, contribute to its effectiveness for deep network penetration. Sliver [7] is an open-source C2 framework developed as an alternative to Cobalt Strike, offering similar functionalities while emphasizing flexibility and modularity. Unlike Cobalt Strike, which primarily focuses on Windows environments, Sliver is cross-platform and supports Linux and macOS as well. Its core features include multiple payload types, such as staged and stageless implants, reflective DLL injection, and support for Golang-based payloads, which makes it harder to detect due to its lesser-known execution patterns. Sliver's main capabilities revolve around its use of encrypted communication channels, such as mTLS and WireGuard tunnels, to ensure secure command execution and data exfiltration. It also supports multiple transport mechanisms, including DNS, HTTP, and HTTPS, providing various evasion options. Post-exploitation capabilities in Sliver include standard techniques like process injection, shellcode execution, and credential dumping, but it does not natively support advanced Kerberos-based attacks like Cobalt Strike. However, its open-source nature allows users to extend its functionality and integrate third-party tools such as Mimikatz or BloodHound for deeper post-exploitation techniques. Mythic [6] is a robust, open-source C2 framework designed for extensibility and modularity. Unlike Cobalt Strike and Sliver, Mythic is entirely open-source and employs an agent-based approach, where each implant (referred to as a \"payload type\") is a separate, independently developed, and customizable component. Key features include a highly customizable web-based interface, encrypted communications, and support for multiple payloads written in various languages, including Python, C#, and Golang. Mythic is notable for its usability, offering a structured API for building custom agents, automating tasks, and integrating with external tools. It supports diverse communication protocols, such as HTTP, TCP, and WebSockets, making it adaptable to various operational requirements. Mythic provides a range of post-exploitation techniques for persistence, credential dumping, and process injection. While it does not natively support advanced Kerberos-based attacks like Cobalt Strike, its modular architecture allows operators to develop and integrate such functionalities as needed. Havoc [16] is a relatively recent C2 framework developed as a modern alternative to Cobalt Strike and Sliver.