C2 Frameworks Analysts See

• Cobalt Strike: commercial red-team tool, heavily pirated. Its Beacon implant is the most common post-exploitation payload in real breaches. Look for shellcode "stagers," malleable C2 profiles, named-pipe SMB beacons.
• Sliver: open-source (Go) C2, popular Cobalt Strike alternative — cross-platform implants, mTLS/DNS/HTTP transports.
• Metasploit / Meterpreter: classic open-source framework; still common in commodity attacks.

• As an analyst you learn to fingerprint these: default ports, JA3/TLS signatures, sleep/jitter patterns, known configuration blocks (Cobalt Strike beacon config is extractable).