Azure Application Proxy C2

This post demonstrates how an attacker (or red team) can abuse Azure AD Application Proxy and its underlying Service Bus transport to implement an OpSec-friendly inbound C2 channel. It covers generating the client authentication certificate via OAuth and CertEnroll, performing the bootstrap request to the msappproxy endpoints, establishing Service Bus/WebSocket signaling channels, retrieving request payloads, and returning C2 responses to /subscriber/connection, and includes a C# PoC implementation.