New Red Team Networking Techniques for Initial Access and Evasion
Introduces advanced offensive networking techniques and covert communication channels to bypass modern enterprise perimeter monitoring and EDR telemetry.
Summary
Modern Perimeter Monitoring Challenges
Enterprise security operations deploy sophisticated Network Detection and Response (NDR) and EDR telemetry pipelines to identify anomalous outbound connections and known command-and-control signatures.
Covert C2 Communication Tradecraft
Jason Lang demonstrates novel networking primitives that blend command-and-control traffic with legitimate cloud services, legitimate CDN fronting, and obscure network protocols to evade traffic inspection.
Bypassing Network Access Controls and Egress Filters
Techniques for leveraging IPv6 tunneling, protocol multiplexing, and dynamic egress routing allow red teamers to establish resilient initial access footholds in highly monitored environments.
Detection Strategies for Blue Teams
Defenders improve visibility by analyzing protocol timing anomalies, inspecting encrypted traffic metadata (JA4), and correlating network flows with host process telemetry.
Related talks
Main Stage·42 min
Gal Weizman
Demonstrates how WebRTC channels and enterprise web conferencing platforms can be repurposed as stealthy command-and-control and data exfiltration pipelines.
Main Stage·45 min
RJ McDown
RJ McDown presents Obligato, a covert implant communication framework that abuses legacy Windows session architectures to decouple C2 traffic from malware processes.
Main Stage·43 min
Quentin Roland · Wilfried Bécard
Demonstrates how red teams can weaponize Active Directory Group Policy Objects (GPOs) into a stealthy, native command-and-control infrastructure.