Detects command-and-control by behavior, not signature.
TSCTI · 22 Innova Labs
Modern command-and-control no longer needs a suspicious server. It hides inside the trusted services your organization already allows — Microsoft Graph API, GitHub, Slack, and cloud storage — so the traffic looks like ordinary business.
And the operator is disappearing too. In AI-driven agentic C2, a language model generates the commands and adapts the evasion in place of a human at a keyboard — faster, quieter, and without a fixed playbook. Signature- and IOC-based detection was built for neither. It misses both.
Normalized telemetry flows through a deterministic pipeline. Every stage is measurable, calibrated, and auditable end to end.
Network egress and endpoint process telemetry normalized into a common schema per monitored entity.
Independent statistical detectors each emit a calibrated [0,1] score on a common scale.
Per-entity fusion with temporal decay, correlation down-weighting, and false-alarm calibration.
Incidents cluster into campaigns with the evidence, tactic chain, and rationale behind every score.
The reasoning layer emits intent; a deterministic policy engine and a human authorize action.
Jitter-tolerant interval detection surfaces the rhythm of a callback — even when it is randomized or adaptively re-timed to look human.
LLM-call detection flags egress to model-inference endpoints with tell-tale request shapes — the fingerprint of an implant reasoning in the loop.
Per-entity baselines expose SaaS and cloud services being driven as covert control channels, against each host's own normal.
The guardrails are architecture, not policy. They are load-bearing constraints the system is built to respect.
The reasoning layer emits intent — never raw executable commands.
A deterministic policy engine plus a human authorizes every response.
Action is limited to assets the operating organization owns and monitors.
No exploit code, no implants, no evasion tooling — defensive only.
Observed artifacts are treated as data and never alter control flow.
Every automated action and investigation conclusion is logged and auditable.