Domain Fronting and High-trust Redirectors with Cobalt Strike
This video shows how to use a high-trust domain as a redirector for Cobalt Strike's Beacon payload with a technique called domain fronting.
Optiv's blog goes through several of the concepts in this video:
https://www.optiv.com/blog/escape-and...
Further Reading:
http://www.icir.org/vern/papers/meek-...
https://trac.torproject.org/projects/...
https://www.securityartwork.es/2017/0...
NOTE: if you opt to go SSL with cloudfront.net, you'll need a valid SSL certificate config in Cobalt Strike. More on this:
http://docs.aws.amazon.com/AmazonClou...
https://www.cobaltstrike.com/help-mal...