> For the complete documentation index, see [llms.txt](https://blog.securehat.co.uk/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://blog.securehat.co.uk/detection-experiments/hunting-for-c3-activity.md).

# Hunting for C3 Activity

{% embed url="<https://labs.withsecure.com/publications/hunting-for-c3>" %}