How do you detect Mythic C2?

Detect Mythic by its default C2 profiles and per-agent host behaviour rather than one signature. On the network, hunt the default HTTP profile URIs/headers and periodic small polling to a single host, and treat long-lived websockets to odd destinations as suspicious. On the host, Apollo loads .NET in memory (hunt CLR load + execute-assembly via ETW), Poseidon is a large Go binary on Linux/macOS, and Medusa is Python making network connections. Beacon-timing analysis works across all agents.

Detecting Mythic C2: Agents, Profiles and C2 Translators

Mythic is a modular, multi-agent C2 with a plugin ecosystem: agents such as Apollo (.NET/Windows), Medusa (Python) and Poseidon (Go, cross-platform), paired with pluggable C2 profiles (HTTP, websocket, DNS) and translators. Detection focuses on default profile artifacts and per-agent host behaviour.

Signals at a Glance

Signal	Where	ATT&CK
Default HTTP profile URIs / headers / polling	Proxy, Zeek	T1071.001
Websocket C2 to non-standard endpoints	Proxy, Zeek	T1071
Apollo .NET assembly load / inline execute-assembly	ETW, Sysmon, EDR	T1620
Poseidon large Go binary (Linux/macOS)	EDR, osquery	T1105
Periodic check-in with jitter	Flow/proxy	T1571

Profiles and Translators

Mythic's default HTTP profile has recognisable URIs and a parameterised polling cadence; the websocket profile is unusual enough that any internal host opening a long-lived websocket to an odd destination deserves a look. Hunt for the polling shape first:

// KQL: periodic small GET/POST polling to a single host (profile-agnostic)
ProxyLogs
| where Method in ("GET","POST")
| summarize reqs=count(), avgLen=avg(ContentLength), hosts=dcount(Host)
          by SrcIp, Host, bin(TimeGenerated, 1h)
| where reqs > 30 and avgLen < 1500
// Then enrich Host with newly-registered-domain and reputation feeds.

Per-Agent Host Behaviour

Apollo runs in-memory .NET: hunt CLR load into non-.NET host processes and execute-assembly patterns via ETW (T1620).
Poseidon and other Go agents appear as large stripped binaries on Linux/macOS — surface them with osquery/EDR and unsigned-binary alerts.
Medusa (Python) shows up as python spawning network connections and child processes in server contexts where that is abnormal.
Across agents, the periodic network heartbeat remains the most reliable signal — apply beacon-timing analysis.

Vetted sources

Mythic is open source and its default profiles are documented per C2 plugin. Treat published URIs as hunting leads (profiles are editable) and lean on per-agent host behaviour plus beacon timing. SigmaHQ covers execute-assembly and CLR-load patterns for the Apollo case.

Build Detections That Fire

Mjolnir Security helps blue teams turn threat intelligence into high-fidelity detections across endpoint, network, identity and cloud telemetry.

Detection EngineeringManaged Detection & ResponseThreat HuntingIncident ResponsePurple Teaming

Detection Engineering We build and tune detections mapped to ATT&CK from your own telemetry.
Threat Hunting as a Service Hypothesis-driven hunts for the behaviours on this page.
24/7 Incident Response Containment when a detection fires. Call +1 833 403 5875.

Written by: Mjolnir Threat Research (MTAC)  |  Published: October 12, 2026  |  Last reviewed: October 12, 2026

Signals at a Glance

Profiles and Translators

Per-Agent Host Behaviour

Build Detections That Fire

C2 Beaconing Detection

Detection Hub

DNS C2 Detection