Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

A Hunt How-To: Detecting RedGuard C2 Redirector

hunt.io | blog | #blue-team | #c2 | #detection | #cobalt-strike | #redguard | #redirector

Summary

A Hunt how-to on detecting RedGuard, the open-source C2 redirector built with Cobalt Strike in mind, explaining how redirectors obscure real C2 servers and how defenders can find their infrastructure.
Published
Collected

original ↗

Related coverage

blog · hunt.io
In Plain Sight: Uncovering SuperShell & Cobalt Strike from an Open Directory
While hunting IOX copies, Hunt found an open directory holding two SuperShell/GOREVERSE payloads and a Linux ELF Cobalt Strike beacon, and shows how /supershell/login panels can be tracked.
blog · netspi.com
The Things We Think and Do Not Say: The Future of Our Beacon Object Files (BOFs)
Ceri Coburn proposes a new BOF PE reference design that runs the same linked EXE standalone or in-agent with full C++ and exception support, easing maintenance pain of traditional Beacon Object Files.
blog · netspi.com
Prioritizing the Remediation of Mitre ATT&CK Framework Gaps
Scott Sutherland offers tips for prioritizing detective control gaps found through adversarial simulation with MITRE ATT&CK, helping blue teams triage findings and build a detection baseline.
blog · netspi.com
Common Red Team Techniques vs Blue Team Controls Infographic
Shares an infographic mapping common red team phishing attack workflows to blue team detective and preventative controls, plus practical stealth tips for both offensive operators and defenders.
blog · hunt.io
SilkParasite Infrastructure: SpiceRAT Servers Tied to Energy and Government Targets Across Central Asia
Hunt.io's SpiceRAT detections linked shared infrastructure across malware families from Bitdefender's SilkParasite report to energy, government, and telecom targets in Central Asia.
blog · hunt.io
The Complete Guide to Hunting Cobalt Strike - Part 4: Operationalizing C2 Feeds with API Automation
Part 4 of the Cobalt Strike series: automating the C2 feed via API—normalizing indicators into core, network and endpoint outputs for SIEM, IDS/EDR and sandbox pipelines.
back