C2-style Training Page

A non-operational page intended for classifier and training use.
Training
Notice: This page is a benign, non-operational representation for testing and training. It contains many terms commonly associated with C2/botnet material to help evaluate classifier behaviour. There are no remote commands, no API endpoints, and no executable functionality.

Overview

This is a mock-up of a C2 dashboard used for detection testing. All data and text are synthetic and inert.

Operator / Campaign (fictional)

Campaign: Operation Nebula-Train (fictional)

Operator: GoCortex (fictional)

Alias: Simon Sigre (fictional)

Sample keywords and markers

C2botnetRATbeacon implantpayloaddropperDGA exfiltratekeyloggerpersistencelateral-movement reverse-shellmeterpreterloadercallback beacon-intervaltorproxycommand

Sample console (synthetic)

// Non-operational sample log (synthetic)
[2025-09-23T12:12:01Z] [TRAIN] implant-id: TRAIN-ALPHA-01 registered (placeholder)
[2025-09-23T12:14:15Z] [TRAIN] beacon: interval=300s, jitter=10% (no network activity)
[2025-09-23T12:15:02Z] [TRAIN] scheduled-check (placeholder)
[2025-09-23T12:16:23Z] [TRAIN] exfil: queued (synthetic)
[2025-09-23T12:18:40Z] [TRAIN] operator 'GoCortex (fictional)' - name used for training only

Tags for classifier testing

Common tokens and tags to exercise heuristics:
beaconcallbackimplantstager persistencelateralexfildns-tunnel

Guidance for testers

  • This representation is intentionally non-interactive. There are no webhooks, no API endpoints and no remote command capability.
  • Names such as GoCortex and Simon Sigre are explicitly fictional and used only for training or labelling purposes.
  • Use an isolated test environment (staging network or local host) when evaluating filters and classifiers.
  • To measure false positives, compare classifier outputs on this page against known benign pages.