PoshC2
Proxy-aware C2 framework with PowerShell, C#, and Python implants, maintained by Nettitude (LRQA).
Technical Architecture & Overview
PoshC2 is a proxy-aware command and control framework written primarily in Python 3, with PowerShell, C#, and Python implants. It supports HTTP(S) and SMB named-pipe communication, lateral movement helpers, payload generation, and a client/server model for multiple operators. Nettitude, acquired by LRQA in 2018, maintains the project and publishes a companion PoshC2_IOCs repository for defenders.
Targeted Technical Use Cases
Authorized engagements where PowerShell-based tradecraft and proxy awareness matter.
Evaluation & Trade-offs
Core Strengths
- +PowerShell ecosystem integration.
- +Maintained by a commercial research team with detection publications.
- +Published IOC repository supports defender validation.
Trade-Offs & Limitations
- -Published IOCs can be circumvented by reconfiguring or altering PoshC2.
- -PowerShell script block logging, when enabled, records the scriptblocks that PowerShell implants run.
Defensive Security Application
Emulating PowerShell-based adversary behavior to validate logging controls such as script block logging.
Frequently Asked Questions
What is PoshC2?→
PoshC2 is a proxy-aware command and control framework written primarily in Python 3, with PowerShell, C#, and Python implants. It supports HTTP(S) and SMB named-pipe communication, lateral movement helpers, payload generation, and a client/server model for multiple operators. Nettitude, acquired by LRQA in 2018, maintains the project and publishes a companion PoshC2_IOCs repository for defenders.
What is PoshC2 used for?→
Authorized engagements where PowerShell-based tradecraft and proxy awareness matter.
What are the strengths of PoshC2?→
- +PowerShell ecosystem integration.
- +Maintained by a commercial research team with detection publications.
- +Published IOC repository supports defender validation.
What are the limitations of PoshC2?→
- +Published IOCs can be circumvented by reconfiguring or altering PoshC2.
- +PowerShell script block logging, when enabled, records the scriptblocks that PowerShell implants run.
How is PoshC2 used defensively?→
Emulating PowerShell-based adversary behavior to validate logging controls such as script block logging.