Needs - Resilience • Expect messages to be lost, and still operate
18
Design Decisions
19
Hyperwave Architecture
20
Example 1 - Transitivity
21
Example 2 - Redundancy
22
Red Team Operational Concerns
23
C&C Detection Fundamentals
24
Control Your Attack Surface
25
Into the App Layer
26
Ways To Detect...
27
Unused Services
28
Process-Traffic Correlation
29
Unique Domain Activity
30
Unique URL Path/Params
31
Headers
32
Authentication Artifacts
33
Behavior - API Usage
34
Behavior - Timing . Our transport polls at X seconds
35
Payload Patterns
36
10. General Behavior
37
Detecting Abuse of: Dropbox
38
Blue Team Questions
39
Unit Testing
40
PC2
41
Questions?
Description:
Explore the evolution of command and control (C2) capabilities in cybersecurity through this comprehensive conference talk from Derbycon 2018. Delve into the history of C2, examining various techniques such as bind shells, reverse shells, and IRC channels. Learn about advanced methods like DNS tunneling and domain fronting, as well as the increasing capabilities of red teams. Understand the key needs for reliability, concealment, and resilience in C2 operations. Examine the Hyperwave Architecture and its applications in transitivity and redundancy. Gain insights into red team operational concerns and C2 detection fundamentals. Discover various detection methods, including process-traffic correlation, unique domain activity, and payload patterns. Explore ways to detect abuse of services like Dropbox. Conclude with a discussion on blue team strategies and the importance of unit testing in cybersecurity operations.
99 Reasons Your Perimeter Is Leaking - Evolution of CC