AI
Separating Command Logic from Transport
The core holds session state and scheduling decisions. The adapter handles protocol-specific input-output. Failover is an engineered feature. When HTTP is blocked, the agent falls back to DNS, then ICMP. Blocking one protocol removes one adapter, leaving command logic intact. Solheim built a custom agent to demonstrate this separation. The same session state persists across protocol changes. The intent and scheduling continue unchanged.
Demo: Three Protocol Failovers, One Session
The demo showed healthy HTTP beaconing. Solheim disabled HTTP. The agent failed over to DNS. She disabled DNS. After three timeout retries, the agent switched to ICMP. With all transports blocked, the agent kept polling. When HTTP was re-enabled, the session resumed. The session ID never changed. Data exfiltration waited in the queue. The demo used a custom agent with no exploits or persistence, only architecture and failover mechanics.
What Transport Blocking Actually Accomplishes
Transport disruption creates a false sense of security. Protocol semantics changed from HTTP to DNS to ICMP. Network indicators changed. Session ID, session state, scheduling intent, and operator workflow did not change. Solheim called this the false sense of security. The containment risk shifted from an active incident to a closed case. The core persists until the host is eradicated at the endpoint level. Organizations cannot isolate hosts forever because DNS and HTTP are needed for updates.
Detecting C2 Across Protocol Changes
Detection must shift from protocol to behavior. Signals that survive transport change include beacon-like periodicity, repeated contact to a single external destination set, and state continuity. Network-layer detection alone is insufficient. Defenders need network and endpoint telemetry together. Practical checks include confirming endpoint state for persistence, scheduled tasks, and injected threads. Look for alternative egress paths. Measure timing for pattern reappearance. Document containment actions explicitly. Verify post-containment and post-eradication.
Notable Quotes
transport disruption does not actually neutralize command logic Francine Solheim · ▶ Watch (0:57)
the containment looks like we’ve eradicated the problem and the state still persists Francine Solheim · ▶ Watch (3:16)
The session ID remained the same. Francine Solheim · ▶ Watch (12:49)
if we kill some transport, we need to assume that it is degraded and not gone Francine Solheim · ▶ Watch (15:29)
Key Takeaways
- Separate command logic from transport in C2 detection. Protocol blocking removes adapters only.
- Validate eradication at the endpoint level after transport disruption. Beacon pattern may reappear on another channel.
- Use network and endpoint telemetry together to detect behavior that survives protocol change.
About the Speaker(s)
Francine Solheim is a cybersecurity architect specialising in defensive architecture and weird tooling. She has worked on SOC augmentation, ISO 27001-driven security programmes and experimental monitoring tools, and is currently focused on piecing together enterprise-grade-but-still-open-source SIEM/SOAR solutions and making advanced attacker techniques understandable and reproducible for ‘normal’ engineering teams.