Introduction
Mythic is a modern, open-source command-and-control (C2) framework designed for collaborative red-team operations, but it has also been adopted by threat actors in real intrusions. As a result, understanding how Mythic works—both architecturally and operationally—is now a core skill for SOC analysts, DFIR practitioners, and detection engineers.[youtube]docs.specterops+1
In this post, we will focus on using Mythic safely in a lab to emulate threats, understand its telemetry, and then turn that into concrete detection and defense strategies, informed by real-world case studies and dark-web-linked activity. All discussion is for authorized testing only and explicitly aimed at improving defenses.team-cymru+1
Background / Overview
Mythic is described by its maintainers as a multiplayer, command-and-control platform with a web-based React UI and a containerized backend built around a Go server, PostgreSQL, RabbitMQ, and Docker. This modular design allows separate agents, C2 profiles, and utilities to run in their own containers or hosts while sharing a unified operational view for operators.docs.specterops+2[youtube]
A key differentiator is Mythic's data modeling and tracking: from payload creation onward, it records C2 profile parameters, command versions, operator identity, timestamps, and even the rationale ("why") for actions, and it integrates MITRE ATT&CK mappings directly into the workflow. This enables red teams—and, in a lab, blue teams—to search across tasks, outputs, artifacts, and ATT&CK coverage, making it a powerful tool for both adversary emulation and threat hunting exercises.netwerklabs+1
Unfortunately, that same power is attractive to attackers. Public reporting has documented the use of Mythic agents such as Athena and Poseidon in campaigns targeting sectors like Russian semiconductor suppliers and Indian government and defense entities. In at least one case, the attack chain combined a WinRAR vulnerability (CVE-2023-38831) with an exploit sold on cybercrime and dark-web forums before eventually deploying an Athena Mythic agent as the second-stage payload.securelist+1
Technical Breakdown / Analysis
This section focuses on how to use Mythic in a controlled lab to understand its workflows and telemetry, not as a real-world attack playbook. Always obtain explicit written authorization before running Mythic against any environment.sleepy-student+1
Mythic Architecture at a Glance
Understanding the architecture is crucial for both red-team use and blue-team detection:[youtube][docs.specterops]
Web UI and API Layer
React front end communicates with a Go server via GraphQL APIs and WebSockets. The Go server handles user authentication, tasking, and coordination between agents, C2 profiles, and the database.[netwerklabs]
Core Services
PostgreSQL stores tasks, callbacks, payload metadata, artifacts, and ATT&CK mapping data. RabbitMQ provides message brokering between Mythic's components and C2 profile containers, enabling loosely coupled communication.[docs.specterops][youtube]
Reverse Proxy
A reverse Nginx proxy exposes a single port and routes traffic to the UI, documentation, GraphQL console, and Jupyter notebooks. For defenders, this means Mythic often appears as a single externally reachable web service even though the backend is composed of multiple containers.[netwerklabs]
C2 Profiles and Agents
Each C2 profile lives in its own container and translates a particular protocol (HTTP(S), WebSocket, Discord, SMB, etc.) into the REST/JSON format Mythic uses internally. Agents (e.g., Apollo, Athena, Poseidon) implement the C2 protocol on target systems and provide commands for discovery, lateral movement, credential access, and more.linkedin+1
How Mythic is Used in Real Operations (Red and Adversarial)
Red teams and, increasingly, adversaries use Mythic in broadly similar patterns:[redsiege]
Initial Access and Execution: Initial access may be achieved via phishing, brute force, exploitation (e.g., CVE-2023-38831 in WinRAR), or other techniques. A Mythic payload (e.g., Athena or Apollo) is then delivered and executed to establish the first callback.[securelist]
Callback and Staging: The agent "phones home" over a configured C2 profile—HTTP(S), WebSockets, Discord via C3, or SMB/TCP in peer-to-peer mode—to the Mythic server. Operators validate the host, tag it, and load additional commands or BOFs (Beacon Object Files) as needed.[docs.mythic-c2]
Post-Exploitation and Lateral Movement: Common workflows include AD enumeration, Kerberoasting, DLL hijacking for privilege escalation, credential dumping, Pass-the-Hash, and eventually DCSync for full domain compromise. In documented cases, operators used Mythic to exfiltrate sensitive data like password files via C2 channels after completing discovery and privilege escalation.[linkedin]
Defense Evasion and Persistence: Operators may disable endpoint defenses (e.g., Windows Defender), schedule tasks, or abuse legitimate services for persistence and covert C2 (e.g., Discord, DNS, or cloud services). The flexibility of Mythic's C2 profiles allows operators to blend into normal network traffic using HTTP(S), WebSockets, or other application-layer protocols.[cybercentaurs]
Building a Safe Mythic Lab for Defenders
Several public resources (LinkedIn SOC challenges, GitHub labs, GitLab's red-team pipelines) show how to deploy Mythic for defensive training, not for unauthorized access. A typical blue-team-focused lab looks like this:[github]
Core Lab Components: A Linux VM running Mythic with at least one HTTP/S C2 profile installed and bound to localhost or a dedicated test segment. One or more Windows and Linux endpoint VMs with EDR/ELK/log collectors installed (e.g., Elastic Defend, Winlogbeat, Sysmon, Suricata sensors).[github]
Install and Configure Mythic (High-Level): Follow the official Mythic documentation to deploy via Docker, ensuring the admin interface is not exposed to the internet (localhost or VPN only). Start with a well-documented agent such as Apollo and a simple HTTP or WebSocket C2 profile to keep telemetry straightforward.[github]
Generate a Benign Payload for Telemetry: In the UI, generate a payload with your chosen agent and C2 profile, setting the callback host to your Mythic server and using a non-sensitive lab hostname. Keep the initial commands minimal (e.g., basic discovery like ipconfig, whoami, directory listing) so you can clearly map telemetry to actions.[sleepy-student]
Execute the Payload in a Controlled Scenario: Use a test "attacker" VM to simulate an initial compromise of a Windows server (e.g., via a lab-only brute-force or RDP test), then deliver and execute the Mythic payload. Run a small, scripted sequence of tasks: host discovery, process listing, file access (e.g., reading a lab-only passwords.txt file), and simple exfiltration of that file over C2.[github]
Instrumenting Mythic Itself: Monitor the Mythic host: track Docker container start/stop events, RabbitMQ connections, PostgreSQL activity, and Nginx access logs for C2 callback patterns. Where possible, enable extended logging on the Mythic server's OS and forward it into your SIEM to correlate "operator actions" with agent activity.[netwerklabs]
Detection & Defense
Network-Level Detection Strategies
Research from securelist and other vendors shows distinct patterns in Mythic's network behavior that can be used for NDR-class detection.[securelist]
Direct Egress (HTTP/S, WebSocket, MQTT, DNS): Mythic agents commonly use HTTP(S) or WebSocket profiles for direct communication, occasionally MQTT and experimental DNS modules. Look for regular, low-volume beaconing to unusual domains/hosts with consistent URI paths and payload sizes; HTTP(S) requests with atypical user-agents, headers, or URIs that don't match known applications in your environment; WebSocket connections from endpoints that normally don't maintain persistent outbound websockets.netskope+1
Peer-to-Peer (SMB/TCP) Pivoting: Mythic supports P2P pivoting via named SMB pipes and TCP sockets between agents. Detection opportunities include internal SMB connections over named pipes that don't align with standard Windows behavior for that asset class; TCP sessions where early packets contain Base64-encoded data that decodes to UUID-like strings—patterns used by some Mythic profiles.[redsiege]
Abuse of Third-Party Services (e.g., Discord): In one Athena case, C2 traffic was routed via a Discord channel through the C3 framework, meaning victims only contacted Discord infrastructure, not an obvious C2 server. Detect by correlating endpoints with no business need for Discord making persistent or high-entropy connections to Discord domains, concurrent suspicious behaviors on the same host (new processes, unusual file access, credential dumping) in the same timeframe as that traffic.[cybercentaurs]
Indicators from Dark-Web-Linked Campaigns
In the WinRAR CVE-2023-38831 campaigns, threat actors used exploits sold on cybercrime/dark-web forums and deployed Mythic's Athena agent as the second stage. Track IOCs associated with such campaigns—malicious archives, staging servers, payload filenames, and scheduler task names (e.g., recurring tasks invoking an aimp2.exe payload)—in threat intel platforms and SIEM rules.team-cymru+1
Endpoint and SIEM-Level Detection
Process and Command-Line Telemetry: Mythic agents often run standard discovery and lateral movement commands (e.g., ipconfig, whoami, net user, net group, AD enumeration tools, credential dumpers). Focus on combinations and context rather than individual commands: short bursts of recon commands from a new or unusual parent process, or from a user account that doesn't normally run such tools.[linkedin]
Agent Binary and Module Artifacts: Public threat intel shows Athena equipped with commands for shellcode injection, credential capture, BOF loading, and more, which may spawn new processes or inject into existing ones. Monitor for unsigned or newly seen binaries running from unusual directories (e.g., AppData\Local\Microsoft\Windows\Ringtone) or temp paths; DLLs or EXEs dropped in service directories followed by service restarts (DLL hijacking scenarios).[xbz0n]
ATT&CK-Driven Detection Mapping: Mythic natively tags commands and tasks with MITRE ATT&CK techniques, which you can mirror in your detections by mapping lab-observed behavior to ATT&CK IDs (e.g., T1005, T1041, TA0011). Use the ATT&CK matrix view and exported telemetry from Mythic labs to identify which techniques are under-detected in your SIEM and create new rules or analytics for them.
Building Detection Rules from Your Own Lab
Community advice from blue-team practitioners is clear: set up your own Mythic instance, run operations, and base detections on observed telemetry—not just threat-intel snippets. Example from a public ELK-Mythic lab: Elastic Defend and Suricata alerts were used to detect Mythic payload deployment, process creation chains, network beaconing, and exfiltration of a passwords.txt file. Export these lab alerts and convert them into production-grade Sigma/ES|QL/KQL rules with tuned thresholds for your environment. [github]
Remediation & Best Practices
Policy and Governance
Explicitly ban unauthorized C2 frameworks (including Mythic) in your acceptable use and security policies; require documented approvals for all red-team C2 deployments. Maintain an internal inventory of approved testing tools, their owners, allowed networks, and time-bounded windows to distinguish legitimate testing from potential compromise.[netwerklabs]
Hardening Your Environment
Network Controls: Restrict outbound connectivity where possible, enforcing egress filtering and proxy controls so only sanctioned destinations and protocols are allowed from sensitive segments. Apply SSL/TLS inspection for high-risk egress paths to gain visibility into suspicious HTTP/S C2 patterns, while respecting privacy and regulatory constraints.[netskope]
Endpoint Security: Deploy endpoint protection/EDR with behavioral detection of C2-like activity (suspicious child processes, credential tools, LSASS access, unusual scheduled tasks). Enforce application control or allow-listing to prevent unsigned or unknown binaries (like typical Mythic agents) from running on critical servers.[xbz0n]
Identity and Access Management: Implement strong authentication (MFA), least privilege, and credential hygiene to make lateral movement and privilege escalation (common Mythic workflows) more difficult. Monitor for anomalous use of admin and service accounts, especially when aligned with C2-like network behavior.[linkedin]
Incident Response Playbooks
Develop playbooks that specifically cover suspected C2 activity: beaconing detection, containment, host triage, memory capture, and long-term eradication of persistence. Incorporate scenarios reflecting Mythic-style behavior, such as HTTP(S) beaconing, Discord-based C2, SMB P2P pivoting, and AD compromise, so your team practices recognition and response before a real incident.[securelist]
Threat Intelligence and Dark-Web Monitoring
Track campaigns where Mythic (or its agents) have been observed, including IOCs, TTPs, and any infrastructure clues gleaned from public reporting and commercial feeds. Where your risk appetite and legal framework allow, ingest vetted threat-intel that monitors cybercrime and dark-web forums for exploits, payloads, and kits that are known to drop Mythic agents like Athena. Feed these IOCs into your SIEM, EDR, and network tooling with appropriate expiration dates and confidence scores, and continuously validate them in your Mythic lab.[team-cymru]
Continuous Testing and Automation
Follow examples like GitLab's red team, who use CI/CD pipelines and automated tests to validate Mythic server and agent behavior after code changes. Build a continuous testing pipeline where Mythic runs scripted "micro-campaigns" in your lab, telemetry is fed into your SIEM/NDR, and automated checks verify that expected alerts fired, raising tickets (e.g., via osTicket) when detection gaps are found.[github]
Key Takeaways
Mythic is a dual-use C2 framework: it provides powerful, well-structured capabilities for red teams but is also actively abused by threat actors, including campaigns that leverage dark-web-sourced exploits.team-cymru+1
Understanding Mythic's architecture—agents, C2 profiles, Dockerized backend, and ATT&CK-aware data model—is essential to designing meaningful detections.docs.specterops+1
Running Mythic in a controlled lab gives defenders ground-truth telemetry to build robust network, endpoint, and SIEM detections, rather than relying solely on static threat-intel IOCs.[github]
Detection requires layered visibility: NDR rules for HTTP/S, WebSocket, SMB/TCP, and service-based C2; EDR for process and injection behaviors; and ATT&CK-mapped analytics in the SIEM.netskope+1
Mature programs integrate Mythic into continuous security testing, using pipelines and scripted campaigns to ensure detections keep pace with evolving C2 tradecraft.[github]
References (optional)
Official Mythic Documentation: https://docs.mythic-c2.net/home
Mythic C2 Profiles Documentation: https://docs.mythic-c2.net/operational-pieces/c2-profiles[docs.mythic-c2]
Kaspersky: Detecting Mythic activity and network behavior analysis https://securelist.com/detecting-mythic-in-network-traffic/118291/[securelist]
Team Cymru: Mythic C2 case study and prevalence vs other frameworks https://www.team-cymru.com/post/mythic-case-study-assessing-common-offensive-security-tools[team-cymru]
CyberSecOps Lab (ELK + Mythic C2 + osTicket): https://github.com/hydracoc/CyberSecOps-Lab-ELK-Stack-Mythic-C2-osTicket-[github]
GitHub Repo: https://github.com/its-a-feature/Mythic[github]
Brief Summary
Mythic C2 has evolved into a highly flexible, open-source framework used by both professional red teams and real adversaries in the wild, including operations that chain in dark-web-sourced exploits. By safely deploying Mythic in a lab, defenders can observe realistic agent behavior, build high-fidelity detections across network and endpoint layers, and continuously validate their SOC's ability to detect and respond to modern C2 activity before it appears in production.netwerklabs+2
Follow Cyberhawk:
YouTube @cyberhawkconsultancy | YouTube @cyberhawkk | TikTok @cyberhawkthreatintel | X @cyberhawkintel | Telegram @cyberhawkthreatintel
Sign up FREE for my web app https://app.cyberhawkthreatintel.com
Keywords: Mythic C2, Mythic framework tutorial, Mythic detection, Mythic Athena, Mythic Apollo, C2 framework, command and control, red team lab, blue team detection, SOC analyst, ATT&CK mapping, Discord C2, SMB pivoting, dark web exploits, threat intelligence, ELK Stack, Suricata rules, NDR detection, DFIR, cyber threat emulation
Hashtags: #MythicC2 #CommandAndControl #ThreatIntelligence #RedTeam #BlueTeam #SOC #DetectionEngineering #CyberSecurity #DFIR #ATTACKFramework #C2Detection #ELKStack #Suricata #NDR #AthenaAgent #CyberThreats #MalwareC2 #cyberhawkthreatintel #cyberhawkconsultancy #cyberhawkk