Overview#
Choosing a scenario is as crucial as the technical work we’ll do later. If we don’t choose a logical and convincing scenario that replicates real and legit behavior, we will get caught, tracked back and laughed at (especially that). Imagine an implant replicating an azure communication but we link it to a AWS CDN which will add its custom headers. This is illogical, bizarre and will definetly get caught easily.
Scenarios I found relevant#
Microsoft Update#
I ran a microsoft update query to look for available updates and intercepted valid requests that seemed easy to replicate its headers and would blend in perfectly in the traffic even if it gets targetted. Here the Request/Reply I found:
Key: :method; Value: POST
Key: :path; Value: /ClientWebService/client.asmx/secured
Key: :authority; Value: fe3cr.delivery.mp.microsoft.com
Key: :scheme; Value: https
Key: cache-control; Value: no-cache
Key: pragma; Value: no-cache
Key: content-type; Value: application/soap+xml; charset=utf-8
Key: accept-encoding; Value: xpress
Key: user-agent; Value: Windows-Update-Agent/1507.2601.30012.0 Client-Protocol/2.90
Key: ms-cv; Value: NFaVOncEbEyj4c+6.1.1.1.5
Key: content-length; Value: 9861
------------------------------------
Key: cache-control; Value: private
Key: content-type; Value: application/soap+xml; charset=utf-8
Key: content-encoding; Value: xpress
Key: vary; Value: Accept-Encoding
Key: server; Value: Microsoft-IIS/10.0
Key: x-powered-by; Value: ASP.NET
Key: x-content-type-options; Value: nosniff
Key: date; Value: Sat, 21 Mar 2026 20:37:59 GMT
Key: content-length; Value: 1502So an implant behaving like a legit microsoft update by querying the same endpoint exactly with the correct headers on a good looking domain that I will eventually buy and link to some Azure CDN endpoint would be a great choice.
Normal Internet Browsing#
I also navigated some Micorosft websites, Outlook, Gmail..etc and here are the artifacts I found:
Key: :authority; Value: browser.events.data.microsoft.com
Key: :method; Value: POST
Key: :path; Value: /OneCollector/1.0/?cors=true&content-type=application/x-json-stream&ext.intweb.msfpc=GUID%3D77cf2e190ecc4ab9836db2c9c7c504ed%26HASH%3D77cf%26LV%3D202603%26V%3D4%26LU%3D1774193917518&w=0
Key: :scheme; Value: https
Key: accept; Value: */*
Key: accept-encoding; Value: gzip, deflate, br, zstd
Key: accept-language; Value: en-US,en;q=0.9
Key: apikey; Value: 1cfc1aff02e4437889594f14c4cad289-5bf9ec06-73a3-4827-a5e7-d709ff3d3b12-6941
Key: cache-control; Value: no-cache, no-store
Key: client-id; Value: NO_AUTH
Key: client-version; Value: 1DS-Web-JS-3.2.18
Key: content-length; Value: 61263
Key: content-type; Value: application/x-json-stream
Key: origin; Value: https://www.microsoft.com
Key: priority; Value: u=1, i
Key: referer; Value: https://www.microsoft.com/
Key: sec-ch-ua; Value: "Chromium";v="146", "Not-A.Brand";v="24", "Google Chrome";v="146"
Key: sec-ch-ua-mobile; Value: ?0
Key: sec-ch-ua-platform; Value: "Linux"
Key: sec-fetch-dest; Value: empty
Key: sec-fetch-mode; Value: cors
Key: sec-fetch-site; Value: same-site
Key: time-delta-to-apply-millis; Value: use-collector-delta
Key: upload-time; Value: 1774881238298
Key: user-agent; Value: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36
----
Key: access-control-allow-credentials; Value: true
Key: access-control-allow-headers; Value: time-delta-millis
Key: access-control-allow-methods; Value: POST
Key: access-control-allow-origin; Value: https://www.microsoft.com
Key: access-control-expose-headers; Value: time-delta-millis
Key: content-length; Value: 24
Key: content-type; Value: application/json
Key: date; Value: Mon, 30 Mar 2026 14:33:59 GMT
Key: server; Value: Microsoft-HTTPAPI/2.0
Key: strict-transport-security; Value: max-age=31536000
Key: time-delta-millis; Value: 1693Navigating some microsoft website or a microsoft service would look perfectly fine with a good looking domain name would leave no traces behind.
A step further
To push it even further, we can intercept more network services depending on the target company’s tooling and create a good Profile redirection rules and of course domain name.
Cloud Asset Delivery#
Simple asset delivery through major cloud providers’ CDNs to mimick some cloud traffic…etc
Github API and some CI/CD traffic#
Mimicking some dev-related traffic to blend in the R&D teams.
We can find some templates for these scenarios in this github repo.
Problems I encountered#
Azure CDN isn’t on the Azure free tier or github student pack. So the Azure scenario should be dropped if you’re relying on free-tier services.
Relatively long time to gain a Google-signed SSL certificates, so you should have pre-built and required SSL certificates to NOT get flagged by its creation date since it’ll get caught easily if it’s bought near the time of the compaign.
Some issues with the terraform files and modules. With the project growing with time, you should set up a unique structure from the beginning to not fall into mistakes and re-writing all the files, names…etc
Naming. Be careful with naming, tags and all. They’re super boring, annoying and very tiring to look at.