Leveraging the blue team's endpoint protection as C2

Endpoint protection solutions such as Carbon Black, CrowdStrike, and so forth commonly provide a built-in command and control infrastructure. This can be misused by an adversary. The red team does not even have to maintain or run their own infrastructure. The objective of an operation might be to gain administrative access to the portal of these systems.

Since the portals are commonly web-based, tactics such as pass the cookie might be performed by adversaries after compromising blue team members. Once they have access, there are features such as Go Live that an adversary can leverage to gain administrative access to any host in the organization running the agent.

Additionally, organizations have to worry about malicious insiders who might misuse such features.

Does the blue team and SOC have proper detections and monitoring in place to catch compromise or misuse? Who watches the watchers? Requiring rigorous monitoring...