Security Engineer
In the previous lab, we identified beaconing as a key behavioral indicator of C2 activity but acknowledged that detecting it requires more than endpoint telemetry. Sysmon couldn't see Sliver's in-memory execution, and HTTPS traffic on port 443 blends seamlessly with legitimate web traffic. NDR tools address this gap through statistical analysis of connection timing but what if you don't have an NDR solution, or it hasn't alerted?
Unlike the previous method, in a real world scenario we will almost never have a clean piece of code to evaluate before it is run by a malicious actor. Because modern C2 frameworks use encryption, and are generally more complex than a Metasploit generated reverse shell, it is harder to detect. Given this, how do we approach detecting APTs using real world frameworks?
Reverse Shells are a common exploit used by C2 frameworks, APTs and Red Team operators. They are fairly easy to configure and provide a way for the actor to control a target device. But what logs are generated by them and how can they be detected?