{"id":669,"date":"2025-08-12T01:58:28","date_gmt":"2025-08-12T01:58:28","guid":{"rendered":"https:\/\/www.cloudcoffer.com\/?p=669"},"modified":"2025-08-12T04:08:22","modified_gmt":"2025-08-12T04:08:22","slug":"case-study-detecting-the-tactics-of-a-well-known-red-team-exercise","status":"publish","type":"post","link":"https:\/\/www.cloudcoffer.com\/?p=669","title":{"rendered":"Case Study: Detecting the Tactics of a Well-Known Red Team Exercise"},"content":{"rendered":"\n

This case study involves a securities company, where CloudCoffer MatrixShield<\/strong> played a critical role in detecting and stopping a simulated red team attack.
The exercise began with an exploited file upload vulnerability and progressed toward establishing persistence and a command-and-control (C2) channel.<\/p>\n\n\n\n

<\/p>\n\n\n\n

1. Initial Access \u2013 Exploiting File Upload Vulnerability of a Shadow API<\/h4>\n\n\n\n

The red team testers identified a file upload feature without sufficient security checks, leveraging a “shadow API” endpoint that was not documented or monitored.
They successfully uploaded a malicious ASP web shell. This file granted the attacker the ability to execute arbitrary code on the server. <\/p>\n\n\n\n

\"\"<\/a><\/figure>\n\n\n\n

<\/p>\n\n\n\n

2. Execution \u2013 Running Malicious VBScript via eval()<\/code><\/h4>\n\n\n\n

The uploaded ASP file contained malicious code centered on the eval()<\/code> function, enabling dynamic execution of VBScript. Key techniques included:<\/p>\n\n\n\n