RedGuard: C2 front flow control tool to avoid Blue Teams, AVs, EDRs check

RedGuard – Excellent C2 Front Flow Control tool

RedGuard is a derivative work of the C2 facility pre-flow control technology. It has a lighter design, efficient flow interaction, and reliable compatibility with go language development. The core problem it solves is also in the face of increasingly complex red and blue attack and defense drills, giving the attacking team a better C2 infrastructure concealment scheme, giving the interactive traffic of the C2 facility a flow control function, and intercepting those “malicious” analysis traffic, and better complete the entire attack mission.

RedGuard is a C2 facility pre-flow control tool that can avoid Blue Team, AVS, EDR, and Cyberspace Search Engine checks.

Application scenarios

• During the offensive and defensive drills, the defender analyzes and traces the source of C2 interaction traffic according to the situational awareness platform
• Identify and prevent malicious analysis of Trojan samples in cloud sandbox environment based on JA3 fingerprint library
• Block malicious requests to implement replay attacks and achieve the effect of confusing online
• In the case of specifying the IP of the online server, the request to access the interactive traffic is restricted by means of a whitelist
• Prevent the scanning and identification of C2 facilities by cyberspace mapping technology, and redirect or intercept the traffic of scanning probes
• Supports pre-flow control for multiple C2 servers, and can achieve the effect of domain front-end, load balancing online, and achieve the effect of concealment
• Able to perform regional host online restriction according to the attribution of IP address by requesting IP reverse lookup API interface
• Resolve strong features of staged checksum8 rule path parsing without changing the source code.
• Analyze blue team tracing behavior through interception logs of target requests, which can be used to track peer connection events/issues
• It has the function of customizing the time period for the legal interaction of the sample to realize the function of only conducting traffic interaction during the working time period
• Malleable C2 Profile parser capable of validating inbound HTTP/S requests strictly against malleable profile and dropping outgoing packets in case of violation (supports Malleable Profiles 4.0+)
• Built-in blacklist of IPV4 addresses for a large number of devices, honeypots, and cloud sandboxes associated with security vendors to automatically intercept redirection request traffic
• SSL certificate information and redirect URLs that can interact with samples through custom tools to circumvent the fixed characteristics of tool traffic
• ………

Install & Use

Copyright (C) {2022} {风起}