Defensive perspective

In the last section, we saw a number of techniques for blending both network traffic and on-host persistence items into the target environment. In this section, we examine some of these techniques more closely, looking at how the covert channels differ from the normal protocols.

We will also look at how to audit and detect various persistence items and rogue executables. The crux of this section is knowing what normal looks like and how to spot an attacker as abnormal in your normal environment. We will end this section by baiting an attacker into revealing themselves with several techniques and traps.

C2 detection

Let's start by looking at ways to detect anomalous traffic. If you can detect malicious traffic on your network, then this is often a strong indicator of which hosts are infected on your network. We can drill down on the infected hosts by first detecting them calling out of the network, then finding which process on a particular host...