tracking-adversary-infrastructure

Tracks adversary C2 and staging infrastructure by clustering indicators on shared attributes (TLS/JARM, certificate fields, favicon hashes, ASN, registration patterns) to find related hosts. Activates for requests to track adversary infrastructure, cluster C2 servers, or pivot on infrastructure attributes to find related hosts.