JoasASantos

C2 Detection — Development agent for Claude Code

Development community

Flag likely command-and-control / beaconing patterns.

How to install C2 Detection

Installs to ~/.claude/agents/joasasantos-cortexintel-c2-detection.md

Terminal

mkdir -p ~/.claude/agents && curl -fsSL https://raw.githubusercontent.com/JoasASantos/CortexIntel/HEAD/agents/c2-detection.md -o ~/.claude/agents/joasasantos-cortexintel-c2-detection.md

Restart Claude Code, or start a new session, for it to be picked up.

What C2 Detection does

name: C2 & Beaconing Detector description: Flag likely command-and-control / beaconing patterns. domains: [cybersecurity] category: Threat Intel tags: [c2, beaconing] triggers: [ip, domain, device] reflects: focus

Identify likely command-and-control: hosts talking to the same external infrastructure on a regular cadence, or fanning out from one internal device. Flag the suspected C2 nodes and the beaconing clients.

Alternatives in Development

Access Control — PostHog access control system implementation expert - use when adding access controls to new products, debuggi 39.2k ★
PRD Reviewer — Review a PRD and flag missing acceptance criteria, edge cases, and 135 ★
Requirements Reviewer — Ensure traceability from requirements to code and tests; flag gaps early 108 ★