Total E(A)gression: Covert Data Exfiltration & C2 Egress Techniques
Álvaro Rueda explores covert egress techniques and data exfiltration channels designed to bypass strict enterprise perimeter firewalls and DLP sensors.
Summary
The Tightening Perimeter of Enterprise Egress Controls
As organizations deploy strict egress filtering, deep packet inspection (DPI), and TLS interception proxies, traditional outbound C2 connections are frequently blocked.
Categorizing Covert Network Egress Channels
Álvaro Rueda analyzes non-standard outbound communication channels—including DNS tunneling, ICMP payload encapsulation, and HTTPS domain fronting.
Abusing Legitimate Cloud Services for Covert Exfiltration
The speaker illustrates using trusted SaaS platforms (e.g., Slack, Telegram, Microsoft Graph, GitHub) as living-off-the-land command and control backends.
Blue Team Egress Telemetry and Anomaly Detection
The presentation provides defenders with detection engineering strategies to identify high-entropy DNS queries, anomalous beacon intervals, and suspicious TLS handshakes.
Related talks
Red Team Village·38 min
An introduction and technical overview of CyberWraith, the Red Team Village's open-source command-and-control and engagement infrastructure platform.
Red Team Village·51 min
Evan Anderson
Evan Anderson explores advanced SSH tunneling techniques, local/remote port forwarding, SOCKS proxies, and stealthy lateral movement strategies.
Red Team Village·1 hr
Eduardo Arriols
Eduardo Arriols breaks down stealthy backdoor deployment and persistent access techniques across enterprise Windows networks, evading blue team hunts.