External C2 (Third-party Command and Control)

Cobalt Strike’s External Command and Control (External C2) interface allows third-party programs to act as a communication layer between Cobalt Strike and its Beacon payload.

A beta of this feature and specification has existed since Cobalt Strike 3.6 (it's implemented in your copy of Cobalt Strike). The specification is not considered final and supported yet. This feature is still under development and consideration.

If you'd like to try it out now, please consult the External C2 specification.

• External C2 Specification

A few "business" matters

If you'd like to adapt the example (Appendix B) in the specification into a third-party C2, you may assume a 3-clause BSD license for the code contained within the specification.

If you'd like to refer to the External C2 spec, please link to this page instead. As the documentation and resources evolve, this page will have the latest information.

Third-party Materials

Here's a list of third-party projects and posts that reference, use, or build on External C2:

• external_c2_framework by Jonathan Echavarria. A Python Framework for building External C2 clients and servers.
• ExternalC2 Library by Ryan Hanson. .NET library with Web APi, WebSockets, and a direct socket. Includes unit tests and comments.
• Tasking Office 365 for Cobalt Strike C2 by MWR Labs. Discussion and demo of Office 365 C2 for Cobalt Strike.
• Shared File C2 by Outflank BV. POC to use a file/share for command and control.