Adversaries use internal proxies to direct command and control traffic between systems in a compromised environment. This technique is used to reduce the number of outbound connections, provide resiliency against connection loss, and blend in with trusted internal communications (e.g., SMB, RPC) to conceal the true destination of C2 traffic.
Requirements: none specified (operational prerequisites may still apply)
Check before starting: RESTRICTED_ACCESS_BLUR_MARKER
Variant:
Full outcome coverage
PortBender · Redirector Mode
Redirector Mode
powershell
RESTRICTED_ACCESS_BLUR_MARKER
Version: RESTRICTED_ACCESS_BLUR_MARKER. Requirements: ALL(RESTRICTED_ACCESS_BLUR_MARKER)Documents all requested outcomes. This is a candidate, not proof of execution or compatibility.preconditions: RESTRICTED_ACCESS_BLUR_MARKERdependencies: RESTRICTED_ACCESS_BLUR_MARKERverification: RESTRICTED_ACCESS_BLUR_MARKERfailure modes: RESTRICTED_ACCESS_BLUR_MARKERlimitations: RESTRICTED_ACCESS_BLUR_MARKERcleanup: RESTRICTED_ACCESS_BLUR_MARKER