Blue/Red Team question: does anyone have an observed example of an someone using x509 certs as part of their offensive tactics, beyond data encryption that is?
Iām putting together a talk on x509 certs and want to cover some historic examples of offensive usages in either red team or bad actor operations.
Please boost for distribution if possible
@ropman76 Thanks! The talk is gonna be about using mTLS as a C2 channel where the coms payload is embedded in x509 certs.
But I also wanted to give a bit of overview of other ways people have used x509 certs as part of their offensive tactics
Here is the link to my talk:
https://cyphercon.com/presentation/secret-handshake-a-mutual-tls-based-c2-communication-channel/
turbo
Tony Ropson