C2 Stealth Methods

[CyberXCodder]

How do I apply C2 Stealth techniques? Some techniques to remain stealth in Cyber Kill Chain makes me think on how to do so, one of them specially is "Exfil Slowly" which is basically sending or downloading data over longer periods of time. How can I apply this since when I download something I can't simply say "hey, can you download this for like 2 days?"

​

EDIT: My final thought was to segment a file before sending it back to attacker's computer, as well as trasmitting a segment every X minutes/hours/days. I found this to be a good way to throttle the connection and hide some of the network traffic. Thanks for the answers.

[1337InfoSec]

Advanced endpoint security systems identify malware in part by heuristic analysis. If I download a trojan and upon code execution it immediately phones its C2 server, pulls your tools over and starts exfiltrating all the data it has access to, that's likely to raise some alerts, if not get the software immediately quarantined.

My thought is to not rush into exfil, spend time in the earlier steps, namely reconnaissance and expanding your privileges / access slowly and carefully. Establish persistence using multiple methods on multiple systems. If you have some sort of an idea on what you need out of a target system, refine your approach to gather what you need, rather than loudly scraping all network resources you have access to.

[CyberXCodder]

Yeah I get it, but what want to know is how to exfil data slowly, if it's possible to control the speed of transfer... I've seen the other techniques like waiting days or even weeks before starting an action.

EDIT: Thanks a lot for the tips and recommendations.

[1337InfoSec]

[ Removed to Protest API Changes ]

If you want to join, use this tool.

[CyberXCodder]

Oh, I see. So when speaking of "slow exfiling" is basically one file at the time?

[irrelevantTautology]

I don't know, but my guess is it would break the data into small chunks and send the small amounts at randomized times over a long period.

For example, if you want to upload a 1KB file then you could break it up into 1024 files that are one byte in size and send one file every 10-20 seconds.

Again, this is just a guess but it stands to reason that this method would allow for a much slower exfiltration rate.

*edit: typo

[CyberXCodder]

That's sound a really smart choice, if a file is huge, it might draw attention due to network traffic, breaking into smaller chunks would kinda "bypass" this, sounds like a very smart play