## 4 Testbed and Test Scenarios
Due to the limitations of direct command execution without an interactive shell, the output of the task was redirected to a file, which was then retrieved. While this file-based approach impacts OpSec, it was necessary given the constraints of covert C2's direct command execution and lack of shellcode support. Alternative solutions for avoiding file system interaction include blind command execution or using a C2 framework with shellcode capabilities. 5. Lateral movement: The _net use_ command was employed to establish a connection to another host via Server Message Block (SMB). Similar to the _schtasks_ scenario, file redirection was used to capture the output. It is noted that enabling WinRM on target hosts would simplify lateral movement and remote command execution with output capture. 6. Random: The last scenario was employed to illustrate the effectiveness of the evasion with random command execution. This means that this scenario used all the previous scenarios in a random order. As a whole, these scenarios were selected to illustrate the post-exploitation and lateral movement capabilities of the proposed communication method. Because the C3 framework is novel and, thus, unknown to EDRs, we strategically selected well-established CMD commands commonly flagged as malicious for our post-exploitation experiments. That is, during red team assessments, certain command-line activities can trigger alerts from EDR systems due to their association with malicious behaviors. These specific activities are known to be leveraged by adversaries; therefore, they are closely monitored by security solutions. The following list describes the familiarity of these commands with malicious activities. * Execution of whoami via CMD: The whoami command is typically used to display the current user's identity. While benign in isolation, its execution can be flagged as suspicious, especially when initiated by uncommon parent processes. For instance, if whoami is executed by applications like Microsoft Word or Excel, it may indicate malicious macro activity. The Australian Cyber Security Centre notes that such behavior is atypical for regular Office operations and warrants investigation [10]. * Execution of pip 8.8.8.8 via CMD: The ping command is commonly used for network diagnostics. However, its misuse can be indicative of malicious activity. For example, malware can exploit Internet Control Message Protocol (ICMP) traffic for C2 communications, embedding data within ping requests and responses. Active Countermeasures discusses how tools like icmpsh provide a reverse shell over ICMP, which can evade traditional network defenses [11]. * Conversion of a file in the Downloads folder to Base64 and uploading to a C2 server: Encoding files in Base64 before transmission is a tactic used to obfuscate data exfiltration. By converting files to Base64, adversaries can bypass content inspection mechanisms that might detect raw binary data transfers. OPSWAT highlights how Base64 encoding can be used to hide malicious payloads, complicating detection efforts [12]. * Use of schtasks to schedule and execute a task as a different user, with output redirected to a file: The abuse of Windows Task Scheduler (schtasks.exe) is a well-documented method for establishing persistence and executing malicious code. Adversaries may create tasks to run under different user contexts, often redirecting output to files for later retrieval. Red Canary's threat detection report emphasizes that scheduled tasks offer adversaries opportunities to inconspicuously conduct various malicious activities [13]. * Employment of _net use_ to establish an SMB connection to another host: The net use command is used to connect to shared resources over the Server Message Block (SMB) protocol. While legitimate for network resource access, adversaries exploit SMB connections for lateral movement within networks. Red Canary notes that detecting a single host making multiple SMB connections to many hosts in a short timespan can be indicative of malicious behavior [14].