Weaponizing Whitelists: An Azure Blob Storage Mythic C2 Profile
ID: 3cfedf97-d22b-5f6d-8a07-9915c29c8652
STIX ID: report--3cfedf97-d22b-5f6d-8a07-9915c29c8652
Feed Name: SpecterOps Blog
This post presents a Mythic C2 profile, azureBlob, that uses Azure Blob Storage for command-and-control to take advantage of common enterprise egress exceptions to *.blob.core.windows.net. It explains setup and deployment, server-side provisioning of per-agent containers with scoped SAS tokens for isolation, the C2 message flow, a minimal Pegasus test agent, and ongoing work to improve SOCKS throughput by adapting ProxyBlob concepts.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.