Offensive perspective

As we start this chapter, we will look at several tactics that help attackers blend into existing programs and protocols. By looking like normal applications or normal traffic, an attacker can run uninterrupted for longer. This chapter aims to harness our principle of deception as a way to protect our running code and our command and control (C2) callbacks. We are also leaning on the principle of humanity, that at first glance these things may appear normal or even important. Granted, there is only so much preparation, obfuscation, and deception attackers can apply; if the defender digs into many of these techniques deeply, there will be tells that reveal the attacker techniques are illegitimate and even malicious. As we will see, it's important for the attacker to also know how closely they mimic reality and where their deception departs, so that they can pivot in their tactics if the defender gets too close. Further, the attacker can think of their persistence...