
OneDrive-UDC2
OneDrive as a covert C2 transport for Cobalt Strike
cloud-securitycommand-and-controldefensive-tools+4
771 month ago

OneDrive as a covert C2 transport for Cobalt Strike

Mythic C2 profile that tunnels agent traffic through Microsoft Teams channels using the Microsoft Graph API, with AES256 encryption, jitter, kill…

Modular command-and-control framework abusing Microsoft Outlook's Home Page feature for stealthy persistence, remote access, and post-exploitation.

Cobalt Strike HTTPS beaconing over Microsoft Graph API