Malware Design: Abusing Legacy Microsoft Transports and Session Architecture
RJ McDown presents Obligato, a covert implant communication framework that abuses legacy Windows session architectures to decouple C2 traffic from malware processes.
Summary
The Fragility of Traditional C2 Network Connections
When EDR solutions detect post-exploitation activity, forensic process-lineage analysis easily links active network sockets directly to injected implant processes, burning entire red-team infrastructures.
Introducing the Obligato Covert Transport Framework
RJ McDown presents Obligato, a specialized implant tasking and communication framework designed to break forensic process chaining and conceal persistence.
Decoupling C2 Traffic from Malware Processes
Obligato abuses legacy Microsoft RPC transports, named pipes, and Windows session architectures to disassociate network telemetry from executing payload memory.
Evading Dynamic Analysis and Resilient Re-Entry
Demonstrating advanced session multiplexing illustrates how covert implants can maintain persistent access and evade dynamic behavior monitoring on modern Windows enterprise hosts.
Related talks
Creator Stage·22 min
Mauro Eldritch · Cybelle Oliveira
Introduces mFT, an open-source tool demonstrating how to use blockchain-backed non-fungible tokens as immutable command-and-control infrastructure.
Main Stage·42 min
Jason Lang
Introduces advanced offensive networking techniques and covert communication channels to bypass modern enterprise perimeter monitoring and EDR telemetry.
Main Stage·42 min
Gal Weizman
Demonstrates how WebRTC channels and enterprise web conferencing platforms can be repurposed as stealthy command-and-control and data exfiltration pipelines.