How to Detect RedGuard C2 Redirectors Using TLS and HTTP Indicators
Summary
A practical guide to detecting RedGuard C2 redirectors using TLS certificate details, HTTP 307 responses, and redirect locations, with a query designed to catch variants that change default settings.
Key points
- RedGuard is an open-source redirector that filters or forwards traffic between implants and command-and-control servers, helping conceal the actual C2 infrastructure.
- The guide identifies default indicators including ports 80 and 443, Aliyun TLS certificate details, configured DNS names, and redirects to 360[.]net.
- RedGuard returns HTTP 307 for temporary redirects; combining this status with response headers and certificate data can help identify servers.
- The example query uses a 307 status, an HTTP Location response header, and a TLS certificate common name matching *.aliyun[.]com.
- Because operators can change default ports, certificates, and redirect destinations, relying only on defaults may miss modified deployments.
Article Details
- Defense Focus
- Detect RedGuard C2 redirector servers by identifying their HTTP redirect behavior and TLS certificate characteristics, including configurations that differ from defaults.
- Detection Methods
- Search network and infrastructure observations for HTTP 307 responses with an HTTP Location response header and a TLS certificate common name matching *.aliyun[.]com.
- Correlate default indicators, including ports 80 and 443, DNS names, redirect location, and certificate attributes; the article cautions that these defaults are easily changed.
- Use the certificate common name and other observed certificate details to search for and filter candidate infrastructure.
- Consider response Content-Type and page-body text containing a “Temporary Redirect” HREF tag as additional query filters; Date and Content-Length are noted as changeable.
- Data Sources
- HTTP response status codes and headers, including Location, Content-Type, Date, and Content-Length
- TLS certificate fields, including common name, locality, and organization
- DNS names associated with RedGuard configurations
- HTTP response body
- Network and infrastructure scanning observations
- Rule Types
- Pseudo network-infrastructure query combining HTTP 307 status, a present HTTP Location response header, and TLS certificate common name matching *.aliyun[.]com
- Platforms
- Hunt
- Defensive Actions
- Save and annotate queries and their results for each detection variant.
- Use multiple behavioral and certificate indicators rather than relying only on default ports, redirect locations, or other defaults that operators can change.
- Treat identified redirectors as potential pivot points; blocking a redirector does not establish that the underlying C2 server has been blocked.
- Use a firewall rule on the C2 server to deny other outgoing traffic, as described in the article’s example.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 45[.]136[.]14[.]85 | Example RedGuard server IP presented as infrastructure for the redirector. |
Vendors
Products
Cobalt Strikeme, you've likely read multiple reports on network intrusions involving a "standard" deployment of Cobalt Strike (or your favorite framework) and the difficulties defenders encountered in detecting the deployedGitHubFigure 3: RedGuard readme: https[:]//github.com/wikiZ/RedGuardAs we've already covered the purpose of a redirector, I'll only highlight some of what makes RedGuard attractive for red teamers and adversaries alike (fromHuntBlue Teamers have improved drastically at creating signatures for and burning adversary infrastructure. Hunt, Censys, and Shodan are just a few sites that actively detect and track some of the more well-known and
Tools
BounceBackThere are many other redirection options on GitHub, such as RedWarden and BounceBack, just to name a few. Apply for a Hunt account today, and let us know what additional redirectors you would like to see tracked on theCensysTeamers have improved drastically at creating signatures for and burning adversary infrastructure. Hunt, Censys, and Shodan are just a few sites that actively detect and track some of the more well-known andRedGuardThis blog post will provide tips and a practical example of detecting RedGuard, a popular open-source redirector built to work with any exploitation framework but built explicitly with Cobalt Strike in mind.RedWardenThere are many other redirection options on GitHub, such as RedWarden and BounceBack, just to name a few. Apply for a Hunt account today, and let us know what additional redirectors you would like to see tracked on theShodanimproved drastically at creating signatures for and burning adversary infrastructure. Hunt, Censys, and Shodan are just a few sites that actively detect and track some of the more well-known and not-so-famous malware