Trisul Network Analytics
Developer Zone

User Tools

Site Tools

You are here: Home » script » Detecting covert channels in X.509 Digital Certificates using the Trisul LUA API
Trace: • Detecting covert channels in X.509 Digital Certificates using the Trisul LUA API
script:x509_ext_c2

This is an old revision of the document!

Detecting covert channels in X.509 Digital Certificates using the Trisul LUA API

I saw a couple of blogs about a new way to create a C2 (Command and Control) channel using X.509 Certificates. This technique is described in _Abusing X.509 Certificates for Covert Data Exchange_ 1)

1)
Dark Reading https://www.darkreading.com/attacks-breaches/abusing-x509-digital-certificates-for-covert-data-exchange/d/d-id/1330984?_mc=sm_dr&hootPostID=a10970e131beaf9b5a7ac86b0564b114
script/x509_ext_c2.1518110533.txt.gz · Last modified: 2018/02/08 22:52 by veera