Liniaal – Empire through Exchange

This post introduces Liniaal, a PoC that extends Ruler and adds a custom Empire listener/agent to stealthily tunnel C2 through Microsoft Exchange using hidden mailbox folders and Outlook transports (MAPI/HTTP or RPC/HTTP), enabling low-and-slow persistence that bypasses typical web gateway inspection, while noting operational caveats such as the need for valid mailbox credentials, an already compromised host, and an active Outlook session.