--- title: "Extending The Covenant: Part 2" description: Further recent changes that we implemented in Covenant, such as new tasks, modified old tasks and a new graph layout. image: https://avantguard.io/hubfs/Extending_The_Covenant_Part_2/inactive_grunts.png --- [Skip to content](https://avantguard.io/en/blog/extending-the-covenant-part-2#main) [![avantguard cyber security](https://avantguard.io/hs-fs/hubfs/LogoInverted.png?width=128&height=61&name=LogoInverted.png)](https://avantguard.io/en/) - [Services](https://avantguard.io/en/services) - [About Us](https://avantguard.io/en/about-us) - [Experience](https://avantguard.io/en/experience) - [Career](https://avantguard.io/en/careers) - [Research](https://avantguard.io/en/blog) - [Contact](https://avantguard.io/en/contact) [DE](https://avantguard.io/blog/extending-the-covenant-part-2) EN [Request an offer](https://avantguard.io/en/request-an-offer) [DE](https://avantguard.io/blog/extending-the-covenant-part-2) EN [Request an offer](https://avantguard.io/en/request-an-offer) [← All posts](https://avantguard.io/en/blog) - [Offensive](https://avantguard.io/en/blog/tag/offensive) - [Red Team](https://avantguard.io/en/blog/tag/red-team) - [Covenant](https://avantguard.io/en/blog/tag/covenant) # Extending The Covenant: Part 2 [![](https://avantguard.io/hs-fs/hubfs/AboutUs/_H3A8038_blog.png?width=40&height=40&name=_H3A8038_blog.png) Jann Lemm](https://avantguard.io/en/blog/author/jann-lemm) December 13, 2022 6 min read ![Covenant Graph](https://avantguard.io/hs-fs/hubfs/Extending_The_Covenant_Part_2/inactive_grunts.png?width=1600&name=inactive_grunts.png) This is the third part of a series of blog posts about our recent work with the open source C2 framework [Covenant](https://github.com/cobbr/Covenant). Again, three new tasks are added for the community to import and use in their own Covenant instances. Be aware that two of them require administrative privileges on the compromised system. I would also like to shoutout another [GitHub repo](https://github.com/py7hagoras/CovenantTasks) containing a lot of helpful Covenant tasks that I have only recently stumbled upon. Additionally, the ProcessList task was modified to perform a grep-like matching in the output. The most notable addition however is the new graph layout, switching from Covenant's default layout to a hierarchical one with additional information. Let's start with the new tasks and what they can be used for during a red team engagement. Sometimes, while looking to find a solution for a problem, you stumble upon a gold mine. That is how I felt when I found [malcomvetter's GitHub](https://github.com/malcomvetter), containing several small C# snippets that focus on one specific task during post-exploitation. Implementing these snippets into new tasks was quick and easy, which is another reason why I like Covenant. The links to the respective snippets are in the help texts of the tasks. All the new tasks can be found on our GitHub page: [Covenant-Additions](https://github.com/avantguard-cyber-security/Covenant-Additions) ProcessWatcher This task requires administrative privileges. It uses WMI to continuously track new process creation events and returns the PID, name, owner and command line arguments for the process (if possible, WMI is too slow at times). This is meant to be used when a system has been compromised to the point that the operator has administrative privileges and is waiting to dump another user's Kerberos ticket or credentials, or to inject into their process etc. ![ProcessWatcher\_example](https://avantguard.io/hs-fs/hubfs/Extending_The_Covenant_Part_2/ProcessWatcher_example.png?width=1320&height=409&name=ProcessWatcher_example.png) While it is possible to have ProcessWatcher run indefinitely by issuing the command "ProcessWatcher 0", it is not advised, as there is a bug in Covenant that when a task is killed, the output pipe seems to be closed for the Grunt. This means that all the tasks that are then run cannot return any output. This is also the case for the KeyLogger and SecurityWatcher tasks and potentially for others too. ![ProcessWatcher\_help](https://avantguard.io/hs-fs/hubfs/Extending_The_Covenant_Part_2/ProcessWatcher_help.png?width=1518&height=258&name=ProcessWatcher_help.png) SecurityWatcher This task requires administrative privileges. It subscribes to the Windows Event Log to track new Security events and returns information about them to the operator. This includes but is not limited to logon, logoff and privilege use. This is again meant to be used when an operator already has admin privileges on a system and wants to keep an eye out for any interesting security events on the machine. It also helps in tracking down what might have led to a disconnection of the implant. ![SecurityWatcher\_example](https://avantguard.io/hs-fs/hubfs/Extending_The_Covenant_Part_2/SecurityWatcher_example.png?width=967&height=702&name=SecurityWatcher_example.png) There are a lot of events collected in a short time. In the example above, a notepad process was started with administrative privileges and then the user logged off. ![SecurityWatcher\_help](https://avantguard.io/hs-fs/hubfs/Extending_The_Covenant_Part_2/SecurityWatcher_help.png?width=1512&height=280&name=SecurityWatcher_help.png) ListOpenWindows Enumerate through all running processes and return the title of the main window. A few processes will not be shown since the main window is hidden (such as explorer.exe), but overall this task allows a quick overview of what the user currently is working on. Since Covenant already offers a screenshot capability, this task is best combined with that to get the window titles and then try to see any interesting information with a screenshot. ![ListOpenWindows\_example](https://avantguard.io/hs-fs/hubfs/Extending_The_Covenant_Part_2/ListOpenWindows_example.png?width=760&height=261&name=ListOpenWindows_example.png) In the example above, a suspicious text file can be seen. If however the notepad window is in the background, a screenshot would not help me. With the file name from the window title, I would now know what to look for. It's an easy example of course, however sadly not an unlikely one. ![ListOpenWindows\_help](https://avantguard.io/hs-fs/hubfs/Extending_The_Covenant_Part_2/ListOpenWindows_help.png?width=814&height=193&name=ListOpenWindows_help.png) Let's now look at the modifications done to ProcessList. ProcessList Get a list of currently running processes. This task is not a new task, it is already in Covenant. However, we wanted to filter the output to only include a search string like with grep. So now, it is possible to append a search term as a parameter to the command (Covenant allows aliases, "ps" can be used instead of ProcessList). If the parameter is left empty, the default output (all running processes) will be returned. ![ProcessList\_example\_1](https://avantguard.io/hs-fs/hubfs/Extending_The_Covenant_Part_2/ProcessList_example_1.png?width=1029&height=155&name=ProcessList_example_1.png) All strings of the output can be matched, so it is also possible to filter for specific PIDs, PPIDs, owners, paths etc. The following screenshot takes the PPID of the previously identified notepad process to search for the parent process and its other child processes. ![ProcessList\_example\_2](https://avantguard.io/hs-fs/hubfs/Extending_The_Covenant_Part_2/ProcessList_example_2.png?width=1232&height=253&name=ProcessList_example_2.png) These were the new and modified tasks. As written at the start, another cool new feature is the new graph layout. Hierarchical Graph I wanted to change the graph's layout for some time now since I wanted to see a bit more clearly how my Grunts and listeners are connected. Covenant uses d3's forceSimulation, which seemed overkill to me. I switched it to d3 tree and a simpler node array, where every node just needs a parent node (except the root node called "Covenant", this was included to allow multiple listeners in the tree), an ID and a fill color. ![inactive\_grunts](https://avantguard.io/hs-fs/hubfs/Extending_The_Covenant_Part_2/inactive_grunts.png?width=1705&height=674&name=inactive_grunts.png) The image above shows what my graph currently looks like. The coloring of the nodes is still the same, but the more greyed out ones are Grunts that have a different status than "Active". Grunts that are set to be hidden are not shown in the graph anymore, neither are deleted ones. This can keep the graph somewhat compact. ![new\_graph\_2](https://avantguard.io/hs-fs/hubfs/Extending_The_Covenant_Part_2/new_graph_2.png?width=1901&height=758&name=new_graph_2.png) Additionally, I wanted to see more information about the Grunt in the details. To allow more information to be shown without requiring a lot of space, I switched from the usual text boxes to pre formatted text. It is not possible anymore to drag nodes around, they are automatically sorted and should always be in the same spot. If you want to use the graph with a light theme, line 278 in master.js can be edited to: `halo = "#222", // color of label halo` When adding these changes to an existing Covenant installation, be sure to run `dotnet clean` before the next `dotnet run` so the changes to the .razor file are applied. Further improvements could include panning and zooming and even more helpful information about the objects in the graph. I'm also thinking about how to modify the Dashboard tab to suit our needs a bit better, and a smaller version of the graph could very well be a part of that initial page. A [pull request](https://github.com/cobbr/Covenant/pull/371) has been opened on Covenant's GitHub page that proposes these changes to be implemented into the dev branch. That's it for the moment! Thanks for reading and as always, feel free to send any questions or remarks to [research@avantguard.io](mailto:research@avantguard.io) or contact me in the BloodHoundGang slack (user @jannlemm0913). Contents - [Offensive](https://avantguard.io/en/blog/tag/offensive) - [Red Team](https://avantguard.io/en/blog/tag/red-team) - [Covenant](https://avantguard.io/en/blog/tag/covenant) ![](https://avantguard.io/hs-fs/hubfs/AboutUs/_H3A8038_blog.png?width=40&height=40&name=_H3A8038_blog.png) Written by [Jann Lemm](https://avantguard.io/en/blog/author/jann-lemm) Research ## Related posts [![](https://avantguard.io/hs-fs/hubfs/Blog/BlueHammerRedSun/bluehammer-1.png?width=800&name=bluehammer-1.png)](https://avantguard.io/en/blog/bluehammer-und-redsun-analysiert) - [Offensive](https://avantguard.io/en/blog/tag/offensive) - [Red Team](https://avantguard.io/en/blog/tag/red-team) - [News](https://avantguard.io/en/blog/tag/news) ### [BlueHammer and RedSun analysed](https://avantguard.io/en/blog/bluehammer-und-redsun-analysiert) This article takes a closer look at two recent vulnerabilities, BlueHammer and RedSun, and explains why they have attracted so much attention. [Andrei Herasimau](https://avantguard.io/en/blog/author/andrei-herasimau) June 9, 2026 15 min read [![](https://avantguard.io/hs-fs/hubfs/Blog/Passwortsicherheit%20im%20Browser/title-small.png?width=800&name=title-small.png)](https://avantguard.io/en/blog/klartext-im-speicher-neubewertung-der-passwortsicherheit-im-browser) - [Offensive](https://avantguard.io/en/blog/tag/offensive) - [Research](https://avantguard.io/en/blog/tag/research) - [Cleartext Credentials](https://avantguard.io/en/blog/tag/cleartext-credentials) ### [Plaintext in Memory: Revisiting Browser Password Security](https://avantguard.io/en/blog/klartext-im-speicher-neubewertung-der-passwortsicherheit-im-browser) This blog post shows how browsers expose passwords in memory and how they can potentially be extracted. [Christian Bieg](https://avantguard.io/en/blog/author/christian-bieg) May 22, 2026 3 min read [![](https://avantguard.io/hs-fs/hubfs/image-3-png.png?width=800&name=image-3-png.png)](https://avantguard.io/en/blog/erfahrungsbericht-ki-gestützte-bof-entwicklung-im-red-team) - [Offensive](https://avantguard.io/en/blog/tag/offensive) - [AI](https://avantguard.io/en/blog/tag/ai) ### [Experience Report: AI-Assisted BOF Development in Red Teaming](https://avantguard.io/en/blog/erfahrungsbericht-ki-gestützte-bof-entwicklung-im-red-team) This blog post details my experience utilizing artificial intelligence in offensive cybersecurity to port a current LSASS dumping tool into a Beacon Object File (BOF) for use in a ... [Sandro Ackermann](https://avantguard.io/en/blog/author/sandro-ackermann) April 8, 2026 7 min read ## Wie sicher sind Ihre Systeme wirklich? Erzählen Sie uns von Ihrem Vorhaben. Sie erhalten ein unverbindliches Angebot. [Offerte anfragen](https://avantguard.io/offerte-anfragen) [+41 55 253 30 30](tel:+41552533030) [![avantguard cyber security](https://avantguard.io/hs-fs/hubfs/LogoInverted.png?width=140&height=66&name=LogoInverted.png)](https://avantguard.io/en/) avantguard cyber security AG Neue Jonastrasse 52 8640 Rapperswil-Jona, Switzerland [+41 55 253 30 30](tel:+41552533030) [info@avantguard.io](mailto:info@avantguard.io) ## Company - [Services](https://avantguard.io/en/services) - [About us](https://avantguard.io/en/about-us) - [Experience](https://avantguard.io/en/experience) - [AI at avantguard](https://avantguard.io/en/ai-at-avantguard) - [Careers](https://avantguard.io/en/careers) - [Research](https://avantguard.io/en/blog) - [Contact](https://avantguard.io/en/contact) ## Services - [Penetration Testing](https://avantguard.io/en/penetration-test) - [Red Teaming](https://avantguard.io/en/red-teaming) - [Attack Simulation](https://avantguard.io/en/attack-simulation) - [FINMA-regulated pentesting](https://avantguard.io/en/finma-regulated-pentesting) - [AD Security Improvement](https://avantguard.io/en/ad_improvement) - [mesher](https://avantguard.io/en/mesher) - [All services](https://avantguard.io/en/services) ## Research - [The Blind Spot Of 802.1X Network Access Control (NAC)](https://avantguard.io/en/blog/die-blinde-stelle-von-802.1x-network-access-control-nac) - [BlueHammer and RedSun analysed](https://avantguard.io/en/blog/bluehammer-und-redsun-analysiert) - [Plaintext in Memory: Revisiting Browser Password Security](https://avantguard.io/en/blog/klartext-im-speicher-neubewertung-der-passwortsicherheit-im-browser) - [Experience Report: AI-Assisted BOF Development in Red ...](https://avantguard.io/en/blog/erfahrungsbericht-ki-gestützte-bof-entwicklung-im-red-team) - [All posts](https://avantguard.io/en/blog) © 2026 avantguard cyber security AG - [Privacy policy](https://avantguard.io/en/privacy-policy) - [Deutsch](https://avantguard.io/)