SpecterOps / SpecterOps/Nemesis

[Feature]: Overwrite default agent_id inside collector (settings_[cobaltstrik|mythic|outflank].yaml)

Open
#111 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

enhancement
Dominant language
Python
Stars
997
Forks
104
PR merge metrics
No merged PRs in 30d

Description

Feature Summary

I would like the option to set the agent_id inside the corresponding settings.yaml for the collector for each c2

Problem / Use Case

Currently, the system only identifies the C2 framework type (e.g., Cobalt Strike, Outflank C2, or Mythic) as the source of a file.

However, this becomes insufficient when multiple instances of the same C2 framework are deployed. For example:

  • cobalt_strike_inital
  • cobalt_strike_post

In such cases, it should be possible to determine which specific C2 instance the file originated from, not just the framework type.

The CLI version of the collector currently supports this but not the ingester for the specific c2s..... (hardcoded here)

Proposed Solution

Outflank C2

metadata = FileMetadata(
                agent_id="stage1",

Cobalt Strike

metadata = FileMetadata(
                agent_id="Cobalt Strike",

Mythic C2

 metadata = FileMetadata(
                    agent_id="mythic",

Repalce this with "agent_id" and expose the settings to the settings.yaml for each c2.

Alternatives Considered

No response

Additional Context

Pull request coming :D

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Locate the C2 ingester code containing the hardcoded FileMetadata agent_id values for Outflank C2, Cobalt Strike, and Mythic, then inspect the corresponding settings_[cobaltstrik|mythic|outflank].yaml files. The work is complete when each collector reads its configured agent_id instead of using a hardcoded value and the ingester metadata identifies the selected C2 instance.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
backend
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.