TTPwire Vol. 1 · MITRE ATT&CK·Tagged

← All stories

Black Hills InfoSec

How to Build a Command & Control Infrastructure with Digital Ocean: C2K Revamped

BHIS · 2018-03-22 · Read original ↗

ATT&CK techniques detected

6 predictions
T1071.001Web Protocols
96%
"##hooks ”. on the webhooks page you ’ ll need to toggle it on in order to activate the feature. once enabled, towards the bottom of the page you ’ ll want to select and create a new webhook. click “ add new webhook to workspace ” and in the popup window select the same channel ( …"
T1071.001Web Protocols
88%
"support to http c2 instances - configure firewall rules for c2 traffic - lockdown ssh access to c2 instances - configure terminal logging - configure logwatch on c2 instances in this post, we will use all of the above features as well as some manual additions such as : - integrat…"
T1071Application Layer Protocol
73%
"ll be executing on each. - payload host – install cobalt strike, install logging and defensive tools. - http host – install cobalt strike, install logging and defensive tools. - https host – install cobalt strike, install https support, install logging and defensive tools. - be s…"
T1071.001Web Protocols
64%
"##s and systems you will not actually have true control over and the ethics of this. it ’ s a valid point and something to consider so be sure you and your customers are aware of the how and where their data will be protected c2k is far from a finished project. there ’ s many new…"
T1071Application Layer Protocol
35%
"support to http c2 instances - configure firewall rules for c2 traffic - lockdown ssh access to c2 instances - configure terminal logging - configure logwatch on c2 instances in this post, we will use all of the above features as well as some manual additions such as : - integrat…"
T1071Application Layer Protocol
33%
"_ url ”. add a domain which you wish to send traffic to that should not touch your team server or does not meet the redirection criteria. then add the c2 domain that traffic should be proxied to ( this is your http c2 instance ). finally, the last function is “ func _ installdefe…"

Summary

Lee Kagan* // Expanding upon the previous post in this series, I decided to rewrite C2K (find it here) to change its behavior and options for the user. In this […]

The post How to Build a Command & Control Infrastructure with Digital Ocean: C2K Revamped appeared first on Black Hills Information Security, Inc..