Your C2 Resolver Is a Public GitHub Gist (and Sometimes a Twitter Bio)
the implant only knows a gist id. githubusercontent hands it the real next hop. your proxy called it developer browsing.
detection engineering
Read Full News
That PNG Is Also a ZIP and Your Gateway Only Checked the Magic Bytes
file says PNG. unzip extracts stage.sh. same bytes, two parsers, one content filter that trusted the greeting.
SSH Over ICMP Because Your Firewall Still Thinks Ping Is Harmless
ptunnel-ng turned echo request into a TCP pipe. your allow-list called it diagnostics. the shell called it tuesday.
Your C2 Is a DNS-over-HTTPS Lookup to Cloudflare and Your SIEM Does Not Care
port 53 is closed. the implant asked cloudflare-dns.com for a TXT and got tasking. your proxy logged browsing.
Hide a C2 Beacon Config in a PNG Pixel and Call It a Profile Pic
the implant downloaded a profile pic, flipped the LSBs, and recovered where to phone home. no PE. just pixels. here is the lab and the hunt.