While defenders have significantly improved in identifying malicious activities taking place on their endpoints and networks, threat actors have also gotten more sophisticated in their evasions. Through clever delivery mechanisms that abuse legitimate services and thoughtful usage of LoLBins (living off the land binaries) many standard detection mechanisms are defeated. This demonstrates and justifies the clear need for defense in depth through a more proactive approach to detection. Join IronNet Threat Research as we discuss proactive detection of C2 frameworks and highlight some of the simple OpSec failures that enable proactive detection of C2 servers, before they are fully deployed on operations.
