Advanced Search Keywords:

opsec:low - Show techniques with low noise level (stealthy)
phase:"initial access" - Filter by phase (use quotes for spaces)
category:lateral - Filter by category
platform:windows - Filter by platform
tag:credential - Find items with specific tag in results
external:true - Show only external techniques

Combining Keywords:

tag:stealth phase:"initial access" password

Searches for "password" within low-noise techniques in the initial access phase

RTT· red team

RTT · red team

Advanced Search Keywords:

opsec:low - Show techniques with low noise level (stealthy)
phase:"initial access" - Filter by phase (use quotes for spaces)
category:lateral - Filter by category
platform:windows - Filter by platform
tag:credential - Find items with specific tag in results
external:true - Show only external techniques

Combining Keywords:

tag:stealth phase:"initial access" password

Searches for "password" within low-noise techniques in the initial access phase

Search techniques, tools, commands…⌘K

No scenario

No scenario · all techniques in scope

IdleStatus

0Scenarios

Advanced Search Keywords:

opsec:low - Show techniques with low noise level (stealthy)
phase:"initial access" - Filter by phase (use quotes for spaces)
category:lateral - Filter by category
platform:windows - Filter by platform
tag:credential - Find items with specific tag in results
external:true - Show only external techniques

Combining Keywords:

tag:stealth phase:"initial access" password

Searches for "password" within low-noise techniques in the initial access phase

Back to Tools

Nighthawk

Noise: RESTRICTED_ACCESS_BLUR_MARKER

C2 Framework

Resource Development

Initial Access

Host Enumeration

Nighthawk is MDSec's commercial command-and-control framework. Its built-in beacon and staged loader workflow are Windows-oriented. Version 0.4 introduced Open Agents integrated with the backend API; vendor Python and .NET examples run on macOS, which demonstrates custom-agent support rather than native macOS support for the built-in beacon. Version 1.0.0 ships an Avalonia operator client for Windows and Linux and updates NHLoader with payload embedding/encoding and persistence options, including WMI event subscriptions, scheduled tasks, service binaries, and COM-hijacking DLLs. Vendor materials also document API-driven beacon tasking, BOF/EXE/.NET execution, NHStager, and version-dependent memory and call-stack masking; the public sources reviewed here do not establish a syntax-complete general CLI invocation for the built-in beacon or NHLoader.

Source

https://www.mdsec.co.uk/nighthawk/

Language

C#/.NET (backend/API), C++ (native components), Python (API/modules and sample Open Agents)

References

mdsec.co.uk mdsec.co.uk mdsec.co.uk nighthawkc2.io nighthawkc2.io

+14 more

Extended Details

RESTRICTED_ACCESS_BLUR_MARKER