HTTPS C2 Self-Signed Cert with Known C2 Framework CommonName (Metasploit/Empire)

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•1

Detects outbound HTTPS traffic containing TLS certificates with common names associated with known command-and-control (C2) frameworks like Metasploit and Empire. These frameworks often use self-signed certificates with default or easily identifiable issuer names when establishing C2 communication.