TL;DR
How attackers and autonomous agents keep control of compromised systems and move data out without tripping domain blocklists. The C2 and evasion techniques seen in modern, machine-speed intrusions.
By John Dill, Red Team Lead, SecureLayer7Updated
Topics
How attackers and autonomous agents keep control of compromised systems and move data out without tripping domain blocklists. The C2 and evasion techniques seen in modern, machine-speed intrusions.
- What is a Dead Drop Resolver?: Instead of a hardcoded C2 domain, malware reads the real server's address from content on
- What is Living-off-Trusted-Services C2?: Run command and control through platforms the network already trusts, paste sites, code ho
- What is a Staged Payload Loader?: A tiny first-stage component fetches and runs the real second-stage payload at runtime, ke
- What is Payload Obfuscation?: Hide the content and intent of malicious code or data with compression, encoding, encrypti
References
- [1]MITRE ATT&CK: Command and Control (TA0011)(MITRE ATT&CK)
Related terms
Find the C2 and exfiltration paths before an attacker does.