We reveal that most modern C2 implants share key functional primitives and introduce low-level runtime telemetry to fingerprint their evasive behaviours. Finally we provide a POC telemetry consumer (lightweight sensor) to identify implants based on the presented runtime data. Fingerprinting modern command-and-control (C2) implants is increasingly difficult for today’s detection sensors. Advanced evasion techniques - such as sleep masking and metamorphic code generation - do not make signature-based memory scanning strictly obsolete, but they substantially reduce its reliability and force defenders to adopt behaviour - and telemetry-driven detection. Those defenses typically rely on heuristic methods - manual call‑stack inspection, thread and memory tracking, and extensive telemetry correlation - that are computationally expensive and thus largely practical only in controlled lab or sandbox environments. We reveal that most modern C2 implants share key functional primitives and introduce low-level runtime telemetry to fingerprint their evasive behaviour. The related evasion techniques are efficiently traceable using low-level runtime telemetry originally intended for performance profiling, such as CPU- and memory-profiling as well as other low-level runtime events emitted by undocumented ETW providers. Among others this allows fingerprinting evasive techniques, such as variations of dynamic code operations, sophisticated process-injection and sleepmasks. By correlating the identified evasive techniques with other typical implant activity - such as network-tunnelling - we show that modern implants can be fingerprinted live and at scale within a production environment. Because these events provide low-level insight into the inner workings of a system, they are particularly difficult for attackers to bypass. Finally we provide a POC telemetry consumer (lightweight sensor) to identify implants based on the presented runtime data to advance the ongoing cat-and-mouse game between malware and defenders.