c2 framework
Covenant
Named by 1 report, 2 detection rules, 0 IOC feeds and 1 tracked actor.
Reports
Detection rules
YARA rules whose family metadata names this family, by detection page.
Detection rules
Open Directory at 193.56.255.154 — XiebroC2 v3.1 & Covenant C2
RAT_Covenant_GruntStager_OpenDirectory, MALW_Covenant_PSFilelessLoader_GruntHTTP
Tracked actors
Designations whose profile lists this family as tooling.
- UTA-2026-002: XiebroC2 and Covenant operator working from a Chinese-language build environment
A family name here is the label the linked rule, feed or profile carries, normalised to one spelling by _data/families.yml. Where a report declines to name a family, this page does not either.