Found an Empire C2 agent mid-conversation with its attacker — here’s how I traced it

Since attacks based on discovery mostly happen through PowerShell, I organized the search around this term and focused primarily on two fields: the Payload and CommandLine. These two fields usually describe the true intention of the attacker while everything else is just noise of the system.

The very first record I found was indeed a heavily obfuscated PowerShell command: a long Base64-encoded string wrapped in familiar flags like -noP, -sta, and -w 1… Attackers use this to launch PowerShell silently, without a visible window and without loading the user's normal profile scripts.

In my opinion, at that time the investigation will conclude with a simple discovery command like net user or net localgroup Administrators that are the first steps of attacks who want to create a map of network resources used. However, the investigation logs provided a better understanding of the situation.

The payload was subject to encryption with the use of RC4 before getting ready for transmission. RC4 is a stream cipher which means that encryption goes one byte by byte not in separate blocks. Its age is significant as the algorithm was created in the late eighties and technically it is weak today but it is very widely used in malware as it is quite lightweight and easy to implement.

In addition, with the help of RC4 the payload is also protected with AES encryption which is the exact opposite from RC4 in terms of security. AES is a standard of encryption used in banks, governments, and almost all the safe software of today. Thus, the presence of AES indicates that the attacker does not hope on chance because if the defender was able to intercept the data flow, breaking AES encryption would be a nearly impossible task.

Discovery of the Beacon

The final piece was a log which had a beacon URL that indicated the destination for the encrypted payload in command and control (C2) communications. This also validated previous discoveries of the encryption layer which suggested that the purpose of this channel was not just for logging purposes but rather to establish communication from a compromised host to the attacker's system.

Key Takeaways

A basic discovery scan that does not make a lot of waves resulted in a full-fledged exfiltration. The innocent-looking command that searched for any other users on the network was just part of the conversation that the compromised machine was having with the attackers.

In the SOC world, the proverbial worst part of an attack may not be the initial compromise. It can be quite the contrary and be how well the malware communicates with its home after deceptively infiltrating the system.