View source for Stealthy peer-to-peer C&C over SMB pipes

{{Publication
|Image=
|Legend=
|Document=
|Licence=
|Type=Blogpost
|Video= 
|Link=http://blog.cobaltstrike.com/2013/12/06/stealthy-peer-to-peer-cc-over-smb-pipes/ blog.cobaltstrike.com
|Author=Raphael Mudge, 
|NomRevue=Cobalt Strike
|Date=2013-12-06
|Editor=Strategic Cyber LLC
|Year=2013
|ISBN=
|Page=
|Botnet=Duqu, 
|Malware=, 
|OffensiveTool=Beacon,
|ExploitKit=, 
|Campaign=
|Campaign2=
|Campaign3=
|Campaign4=
|Campaign5=
|Service1=
|Service2=
|Service3=
|Service4=
|Service5=
|Vulnerability1=
|Vulnerability2=
|Vulnerability3=
|Vulnerability4=
|Vulnerability5=
|CCProtocol=, 
|Operation=, 
|Abstract=Beacon is my payload for low and slow control of a compromised system. Recently, I added peer-to-peer communication to Beacon. When two Beacons are linked, the child Beacon will get its tasks from and send its output through its parent. Linked Beacons use SMB pipes to communicate. This is a big win for stealth. If a workstation Beacon communicates with a domain controller Beacon over SMB, who would notice?
|Keyword=, 
}}