Security Research · 2025 · Covert-channel C2
Protocol Cinema
Research into a steganographic command-and-control technique that tunnels data through public APIs. Studied in an authorised lab, then translated into detection logic for anomalous outbound channels and mapped to MITRE ATT&CK.
- Covert channels
- Traffic analysis
- Detection engineering
- MITRE ATT&CK
objective
Understand a covert command-and-control channel well enough to write the detection for it.
environment
- Authorised lab
- Public API traffic
- MITRE ATT&CK
approach
- 01Studied a steganographic technique that tunnels data through legitimate public APIs, entirely inside an authorised lab.
- 02Characterised the resulting traffic behaviour rather than the payload, since the payload is the part that hides.
- 03Translated the observed behaviour into detection logic for anomalous outbound channels and mapped it to ATT&CK.
outcome
- ›Detection logic for covert exfiltration over web protocols.
- ›No live third-party infrastructure was involved at any point.
highlights
- $Analysed covert exfiltration over legitimate public APIs
- $Converted observed TTPs into detection logic
- $Lab-only — no live third-party infrastructure involved
scope
Every technique referenced here was executed inside authorised environments — my own virtualised lab hosts, DVWA, and systems I was engaged to assess. Attack simulation is always paired with the detection or hardening that answers it: that pairing is the whole point of the work, not a disclaimer on it.