## 7 Comparison with Existing C2 Frameworks
Each framework employs distinct methods for evasion, persistence, and command execution, significantly influencing its effectiveness in real-world operations. In this context, despite its power and versatility, Cobalt Strike has become a prime target for cybersecurity defenses due to its widespread use by both red teams and threat actors. Consequently, many EDR and AV solutions incorporate signatures to detect its default Beacon payloads, necessitating increased reliance on custom malleable C2 profiles and advanced obfuscation techniques for successful evasion. While features like sleep obfuscation, indirect system calls, and process injection enhancements can improve stealth, the heightened scrutiny of Cobalt Strike traffic and techniques has contributed to the growing adoption of alternative C2 frameworks. Continuing this line of thought, Sliver, due to its open-source nature and implementation in Go, often benefits from a lower detection rate compared to Cobalt Strike, as Go-based malware is less frequently analyzed by security researchers. It offers robust encryption, transport-layer obfuscation, and modular payloads, enabling operators to blend its traffic with legitimate network activity. The use of mTLS and WireGuard tunnels enhances its resilience to traffic analysis, providing secure communication channels that are difficult to intercept. Furthermore, Sliver's cross-platform compatibility makes it a suitable choice for campaigns targeting Linux and macOS systems, where traditional Windows-centric C2 frameworks are less effective. By the same token, Mythic's modular design enables operators to create customized implants dissimilar to well-known payloads, thereby increasing the difficulty of detection. In contrast to Cobalt Strike's fixed feature set, which has been extensively studied by defenders, Mythic's dynamic nature allows for continuous modification of attack techniques. By employing diverse payload types and execution methods, Mythic operators can circumvent behavioral-based detections relying on common patterns in established C2 frameworks. However, Mythic's reliance on community-developed plugins means its effectiveness is largely contingent on their maintenance and updates. As a more recent framework, Havoc benefits from a relative lack of widespread detection signatures, making it a potentially attractive option for red teams seeking to avoid signature-based detection. It incorporates modern evasion techniques, including direct _syscalls_, manual payload mapping, and in-memory execution, all of which contribute to increased resistance against traditional security tools. Havoc's customizable payloads and encrypted communication channels further enhance its stealth capabilities. However, its relative immaturity compared to established frameworks like Cobalt Strike and Sliver means its ecosystem of tools and third-party integrations is less developed, potentially requiring operators to create custom modules for comparable functionality. As a novel approach, C3 logically exhibits a lower detection rate against EDRs compared to more established C2 frameworks. Its unique implementation and attack capabilities, specifically direct command execution within the OS and a minimal reliance on traditional evasion techniques (beyond reflective DLL loading), represent a significant achievement. However, this direct command execution approach presents certain limitations. For instance, implementing interactive shell communication is challenging. Consequently, commands requiring interactive shell functionality, such as _runas_ or _ssh_, can be difficult to execute directly. Conversely, employing alternative methods, such as utilizing _schtasks_ instead of _runas_, can enhance operational security and contribute to lower detection rates. Another significant differentiating factor among these C2 frameworks is their ease of use and accessibility. Cobalt Strike, despite its power, presents a steep learning curve, demanding substantial experience in red teaming and offensive security for effective utilization.