In a Red Team engagement, the C2s that are installed and configured are the team servers that are used to manage the reverse connections. In the previous chapters, we have covered Koadic, Armitage, Cobalt Strike, and Empire. All of these tools have one thing in common: they are frameworks that can get a reverse connection and manage multiple connections at the same time. These C2s are crucial in a red team engagement. From the basic instances that we looked at in previous chapters, we now have to think bigger.
One of the biggest issues in red team operations is the detection of the payload by antivirus software or firewalls. Even if our payload is not detected, the outgoing connection (also known as egress traffic) from the target server may well be detected by the monitoring team. How can we perform a red team operation without our Redirector or C2 being blacklisted...
