Skip to content

[Feature]: Overwrite default agent_id inside collector (settings_[cobaltstrik|mythic|outflank].yaml) #111

@IC3-512

Description

@IC3-512

Feature Summary

I would like the option to set the agent_id inside the corresponding settings.yaml for the collector for each c2

Problem / Use Case

Currently, the system only identifies the C2 framework type (e.g., Cobalt Strike, Outflank C2, or Mythic) as the source of a file.

However, this becomes insufficient when multiple instances of the same C2 framework are deployed. For example:

  • cobalt_strike_inital
  • cobalt_strike_post

In such cases, it should be possible to determine which specific C2 instance the file originated from, not just the framework type.

The CLI version of the collector currently supports this but not the ingester for the specific c2s..... (hardcoded here)

Proposed Solution

Outflank C2

metadata = FileMetadata(
                agent_id="stage1",

Cobalt Strike

metadata = FileMetadata(
                agent_id="Cobalt Strike",

Mythic C2

 metadata = FileMetadata(
                    agent_id="mythic",

Repalce this with "agent_id" and expose the settings to the settings.yaml for each c2.

Alternatives Considered

No response

Additional Context

Pull request coming :D

Metadata

Metadata

Assignees

No one assigned

    Labels

    enhancementNew feature or request

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions