A penetration tester wants to establish a Command and Control channel that blends with normal corporate traffic and is unlikely to be blocked by enterprise security controls. Which C2 channel is hardest to detect and block while appearing legitimate?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because HTTPS C2 through legitimate cloud services (CDNs, Azure, AWS, GitHub) blends with normal business traffic, uses allowed protocols, encrypts the C2 channel, and is difficult to distinguish from legitimate service use without deep SSL inspection and behavioral analysis. A is wrong because custom protocols on non-standard ports (like 4444) are easily blocked by egress firewall rules that only allow standard ports.
Full explanation below image
Full Explanation
B is correct because HTTPS C2 through legitimate cloud services (CDNs, Azure, AWS, GitHub) blends with normal business traffic, uses allowed protocols, encrypts the C2 channel, and is difficult to distinguish from legitimate service use without deep SSL inspection and behavioral analysis. A is wrong because custom protocols on non-standard ports (like 4444) are easily blocked by egress firewall rules that only allow standard ports. C is wrong because IRC on port 6667 is a well-known malware C2 channel that is typically blocked by enterprise firewalls at the perimeter. D is wrong because ICMP tunneling is detectable by monitoring ICMP data field sizes and timing anomalies; many organizations also block or rate-limit ICMP outbound.