Summary
In conclusion, there are many ways for attackers to blend into the existing environment. Doing so will help them stay on the victim host longer and potentially avoid detection. We saw how attackers can strengthen their positions by setting up persistence and decoupling their operational implants. We also explored many ways for attackers to obfuscate their C2 protocols, by abusing legitimate protocols. There are also still many techniques available to defenders to highlight abnormal traffic patterns, drill down on infected hosts, and root out persistence items. Further, defenders can add many utilities and sensors to a host to enrich their various logs and understanding of the executables on the system. Finally, the defender can set juicy traps and lure the attacker out of their hidden positions. While there are many variations on these honey techniques, they ultimately rely on defenders deceiving the attacker into thinking the honey infrastructure is a legitimate target.
...
