piecer

What an agent can do with the c2hunter corpus

piecer/c2hunter: Open-source C2 hunting platform that correlates network traffic across sensors to detect, score, and investigate botnet command-and-control

• Look up how c2hunter implements blue-team, botnet, c2, with answers cited to file and line.
• Reuse a worked example: the commit “preserve coverage and TCP observation correctness” (22 files · Python, TypeScript).
• Answer from c2hunter's real Python source instead of memory (Security and vulnerabilities).

• Where does c2hunter handle “preserve coverage and TCP observation correctness”?
• How does c2hunter implement blue-team?
• What does analysis do in c2hunter?

Search the GitHub repository piecer/c2hunter with XERJ (https://hub.xerj.org/corpus/piecer--c2hunter).
Run these in a shell, in order, and check each result before the next:
1. xerj --help  (success: it prints usage). If xerj is missing: curl -fsSL https://xerj.org/get | sh
2. git clone https://github.com/piecer/c2hunter c2hunter && git -C c2hunter checkout 1b262ff628a22aae8364152913747395225c0b44
3. Start a local node and leave it running: xerj --insecure --data-dir ./xerj-data
4. xerj autoindex ./c2hunter --url http://127.0.0.1:9200 --prefix c2hunter --progress plain
5. xerj autoindex map --url http://127.0.0.1:9200
Then answer my question from the indexed files and cite the ax_path of every hit. Query syntax: https://xerj.org/llms.txt
Licence: Apache-2.0. Keep the copyright notice and credit the authors.

corpus piecer--c2hunter · Security and vulnerabilities
Related corpora: dispatch, splunk-security-content, Siddarthb07/corvex, 0x0allenace/email-conversation-integrity-detection
Code security audit with XERJ · Case study: reference coding for agents