{
	"id": "30750b83-9ad3-4b73-a859-af51df5be4fd",
	"created_at": "2026-04-06T00:10:35.771383Z",
	"updated_at": "2026-04-10T13:11:19.260796Z",
	"deleted_at": null,
	"sha1_hash": "4576e8e80161c543241bfa6d2794826b1d7718f5",
	"title": "GitHub - cobbr/Covenant: Covenant is a collaborative .NET C2 framework for red teamers.",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 275413,
	"plain_text": "GitHub - cobbr/Covenant: Covenant is a collaborative .NET C2\r\nframework for red teamers.\r\nBy cobbr\r\nArchived: 2026-04-05 15:07:23 UTC\r\nccoonnttrriibbuuttoorrss 13\r\n ccoommmmiitt aaccttiivviittyy 00//wweeeekk Stars 4.7k lliicceennssee GGPPLL--33..00 chat ##ccoovveennaanntt\r\nCovenant is a .NET command and control framework that aims to highlight the attack surface of .NET, make the\r\nuse of offensive .NET tradecraft easier, and serve as a collaborative command and control platform for red\r\nteamers.\r\nCovenant is an ASP.NET Core, cross-platform application that includes a web-based interface that allows for\r\nmulti-user collaboration.\r\nhttps://github.com/cobbr/Covenant\r\nPage 1 of 3\n\nQuick-Start Guide\r\nPlease see the Installation and Startup guide to get started with Covenant!\r\nThe Wiki documents most of Covenant's core features and how to use them.\r\nFeatures\r\nCovenant has several key features that make it useful and differentiate it from other command and control\r\nframeworks:\r\nIntuitive Interface - Covenant provides an intuitive web application to easily run a collaborative red team\r\noperation.\r\nMulti-Platform - Covenant targets .NET Core, which is multi-platform. This allows Covenant to run\r\nnatively on Linux, MacOS, and Windows platforms. Additionally, Covenant has docker support, allowing\r\nit to run within a container on any system that has docker installed.\r\nMulti-User - Covenant supports multi-user collaboration. The ability to collaborate has become crucial for\r\neffective red team operations. Many users can interact with the same Covenant server and operate\r\nindependently or collaboratively.\r\nAPI Driven - Covenant is driven by an API that enables multi-user collaboration and is easily extendible.\r\nAdditionally, Covenant includes a Swagger UI that makes development and debugging easier and more\r\nconvenient.\r\nListener Profiles - Covenant supports listener “profiles” that control how the network communication\r\nbetween Grunt implants and Covenant listeners look on the wire.\r\nhttps://github.com/cobbr/Covenant\r\nPage 2 of 3\n\nEncrypted Key Exchange - Covenant implements an encrypted key exchange between Grunt implants\r\nand Covenant listeners that is largely based on a similar exchange in the Empire project, in addition to\r\noptional SSL encryption. This achieves the cryptographic property of forward secrecy between Grunt\r\nimplants.\r\nDynamic Compilation - Covenant uses the Roslyn API for dynamic C# compilation. Every time a new\r\nGrunt is generated or a new task is assigned, the relevant code is recompiled and obfuscated with\r\nConfuserEx, avoiding totally static payloads. Covenant reuses much of the compilation code from the\r\nSharpGen project, which I described in much more detail in a previous post.\r\nInline C# Execution - Covenant borrows code and ideas from both the SharpGen and SharpShell projects\r\nto allow operators to execute C# one-liners on Grunt implants. This allows for similar functionality to that\r\ndescribed in the SharpShell post, but allows the one-liners to be executed on remote implants.\r\nTracking Indicators - Covenant tracks “indicators” throughout an operation, and summarizes them in the\r\nIndicators menu. This allows an operator to conduct actions that are tracked throughout an operation and\r\neasily summarize those actions to the blue team during or at the end of an assessment for deconfliction and\r\neducational purposes. This feature is still in it’s infancy and still has room for improvement.\r\nDeveloped in C# - Personally, I enjoy developing in C#, which may not be a surprise for anyone that has\r\nread my latest blogs or tools. Not everyone might agree that development in C# is ideal, but hopefully\r\neveryone agrees that it is nice to have all components of the framework written in the same language. I’ve\r\nfound it very convenient to write the server, client, and implant all in the same language. This may not be a\r\ntrue “feature”, but hopefully it allows others to contribute to the project fairly easily.\r\nQuestions and Discussion\r\nHave questions or want to chat more about Covenant? Join the #Covenant channel in the BloodHound Gang\r\nSlack.\r\nSource: https://github.com/cobbr/Covenant\r\nhttps://github.com/cobbr/Covenant\r\nPage 3 of 3",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"MITRE"
	],
	"origins": [
		"web"
	],
	"references": [
		"https://github.com/cobbr/Covenant"
	],
	"report_names": [
		"Covenant"
	],
	"threat_actors": [],
	"ts_created_at": 1775434235,
	"ts_updated_at": 1775826679,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/4576e8e80161c543241bfa6d2794826b1d7718f5.pdf",
		"text": "https://archive.orkl.eu/4576e8e80161c543241bfa6d2794826b1d7718f5.txt",
		"img": "https://archive.orkl.eu/4576e8e80161c543241bfa6d2794826b1d7718f5.jpg"
	}
}