Nemesis 2.X Guide Shows How to Build Enrichment Modules, Rules, and C2 Connectors
Summary
A hands-on Nemesis 2.X development guide shows how to build and test file-enrichment modules, including LSASS minidump parsing with pypykatz, customize YARA and Nosey Parker rules, and create C2 connectors, with optional Claude Code and Codex skills.
Key points
- The guide walks through building a file-enrichment module that identifies LSASS minidumps and parses them using pypykatz.
- It recommends testing modules with sample files, service logs, and end-to-end tests that verify enrichment results.
- Nemesis supports adding and reloading YARA rules and customizing Nosey Parker scanner rules.
- C2 connectors can send downloaded files and metadata to the Nemesis API; implementation depends on the C2 platform's available interfaces.
- Claude Code and Codex skills can assist with module development, with human review gates for output mode, parsing libraries, and test files.
- The guide describes using a separate service and API integration for processing that is not suited to a Python enrichment module.
Article Details
- Topic
- Nemesis 2.X development: creating file-enrichment modules, customizing Yara and Nosey Parker rules, and building C2 connectors.
Products
Tools
Nosey ParkerNemesis supports dynamic Yara rule management and Nosey Parker rule customization for enhanced threat detection.ProcDumpFirst, it helps to have a sample file, so let’s produce one from a test system using Microsoft’s signed process dumper: ProcDump.pypykatzThe guide demonstrates creating new file enrichment modules, including parsing LSASS memory dumps using pypykatz.YARANemesis 2.X offers a simplified and more extendable platform for creating file enrichment modules, Yara rules, and C2 connectors, improving usability for developers and security researchers.YARA-X # "yara-x>=1.0.1,<2.0.0", # if you're using a Yara signature in should_process()