Power Automate C2: Stealth Living-Off-the-Cloud C2 Framework
summary
Demonstrates a working C2 built entirely inside Power Automate: a Python toolkit called Pack2 Python framework generates initial “downloader” flows that fetch and install payload flows, uses CreateFlow/DeleteFlow via Power Automate Management and Dropbox/HTTP for C2, steals stored connection IDs, and maintains a session after credential changes while deleting flow execution logs (28‑day retention). Live demo shows Teams messages and files exfiltration; mitigation is to block the Power Automate Management connector via DLP.
AI-written summary · about
chapters (17)
- 0:00Introduction
- 1:30Power Automate basics and risks
- 5:26Power Automate attack cases
- 7:30Power Automate C2 concept and features
- 10:00Power Automate Managementコネクターの活用
- 12:08C2 communication and flow automation
- 17:27Power Automate C2 advantages
- 17:48Pack2 overview and features
- 20:18Pack2 architecture and modules
- 21:23Pack2 portal demo
- 26:26Portal task execution and data collection
- 28:58Pack2 stealth and persistence
- 29:40Pack2 session cleanup
- 30:01Binary operations in Power Automate
- 34:19Real-world use cases and countermeasures
- 35:22Summary and future outlook
- 36:05Q&A
related talks
54mCredential Sharing As A Service: The Dark Side Of No Code
25mWindows 11 At Your Service
46mLiving off the Cloud: A Server-Free Approach to Malware Ops
40mLearning from the Enemy: A Look Inside the Techniques of Ocean Lotus /APT32
49mLiving off Microsoft Copilot
25mBack To The Future: Old Tricks Invading A New Attack Surface
44mFlying a False Flag: Advanced C2, Trust Conflicts, and Domain Takeover
50mAutomating security monitoring