OneDrive-UDC2
OneDrive as a covert C2 transport for Cobalt Strike
Details
- External ID
- 1376690432
- Source
- GITHUB
- Company
- —
- Product
- OneDrive-UDC2
- Website domain
- github.com
- Launched
- Sept. 19, 2026
- Cohort
- —
- Upvotes
- 61
- Upvotes percentile
- 0.8643351268255188
- Tags
- —
- Fetched at
- Sept. 23, 2026, 5:02 p.m.
- Updated at
- Sept. 23, 2026, 5:02 p.m.
Enrichment
- Theme
- low-level systems and developer tools
- Vertical
- Security
- Function
- Dev tools
- Audience
- Developer
- AI stance
- Not AI
- Project type
- Hobby / open-source project
- Normalized one-liner
- onedrive-based command and control transport for cobalt strike
- Manually corrected
- False
Could you build this?
Partial While wrapping the Microsoft Graph API is standard, building an in-memory Cobalt Strike User-Defined C2 (UDC) transport DLL with evasion considerations requires specialized offensive development expertise.
What it would actually take: The tool consists of a client-side C/C++ Beacon plugin adhering to Cobalt Strike's External C2 / UDC specification and an external server handler. The hard part is writing native C code that authenticates silently against Microsoft Graph without touching disk, polls OneDrive folders asynchronously, and avoids behavioral detection from enterprise EDR solutions.
Competitors
Other products that read as similar to this one — 411 launches clear the similarity bar, closest 8 shown.
Attention rank: #54 of 412 (itself plus its competitors, highest first — normalized so YC and Product Hunt are compared fairly).
Launched 323 days after the earliest competitor.
- GhostShell · github · 2026-09-19 · 12 upvotes · similarity 0.52
- Fortress · hn · 2026-07-08 · 43 upvotes · similarity 0.49
- polyxor · github · 2026-09-26 · 53 upvotes · similarity 0.45
- genpark-diffie-hellman-ratchet-forward-secrecy-skill · github · 2026-09-09 · 8 upvotes · similarity 0.44
- genpark-diffie-hellman-ratchet-forward-secrecy-skill · github · 2026-09-09 · 8 upvotes · similarity 0.44
- A fast, dependency-free traceroute implementation in pure C · hn · 2025-10-31 · 29 upvotes · similarity 0.42
- PentestPi · github · 2026-09-09 · 15 upvotes · similarity 0.41
- NEXUS · github · 2026-09-13 · 9 upvotes · similarity 0.41
Other launches for this product
- No other launches for this product.
Same idea, different domain
Nobody's really built a dev tools tool for Sales yet.