Attributing a 4-framework intrusion offline (CS + Sliver + Havoc + AdaptixC2)

[cognis-digital]

One C2 detection tells you what a host is. The thing that actually moves an incident forward is attributing every stage of an intrusion. The new demos/04_incident_response.py replays telemetry from a single intrusion that staged four different frameworks, fully offline:

[CRITICAL] 10.20.0.10   Cobalt Strike   conf 100%   (ja3, jarm, port, uri, beacon)
[HIGH    ] 10.20.0.11   Sliver          conf 100%   (ja4, jarm, port)
[HIGH    ] 10.20.0.12   Havoc           conf  76%   (jarm, port, uri, http_banner)
[HIGH    ] 10.20.0.13   AdaptixC2       conf  62%   (port, uri, http_banner, cert_quirk)

Each beacon is attributed by the indicators that actually matched — no guessing, no invented confidence. AdaptixC2 (the fast-growing 2025–26 open-source C2) is keyed on its branded Server: AdaptixC2 header and default /endpoint URIs.

Run it yourself:

PYTHONUTF8=1 python demos/04_incident_response.py

How many frameworks do you typically see staged in a single intrusion, and which ones would you most want added to the signature DB next? The current DB covers 21 families — c2detect db lists them.