sneaky-creeper
sneaky-creeper copied to clipboard
Beaconing Behavior
We should introduce some parameters and configuration around sneaky-creeper's behavior when it comes to reaching out into the Internet.
TODO:
- [ ] Obey rate limits
- [ ] Enhance rate limit specifications already in the code so that the rate limits can be specified more accurately, whether they're daily, hourly, every 15 minutes, etc.
- [ ] Allow for specifying sleep time between beacons
- [ ] Allow for specifying skew/randomness into beaconing to avoid obvious frequency-domain spikes.
A great example to aspire to a subset of is Cobalt Strike's malleable C2.
I'd only say that "sleep time between beacons" and "skew/randomness" should not be enforced by our library but by the 3rd-party tool (in our case, the screep
example program), since sneaky-creeper is a library now.
I was thinking to about the rate limits yesterday while working on the other issues. I'll try to take a look.