This week, Zac sits down with Michael Sviben. Michael is the co-founder and COO of Domain Guard (https://guardyourdomain.com). Domain Guard is a full service domain management platform offering services including Domain Monitoring, Brand Monitoring, Attack Surface Monitoring, Phishing Site Takedowns, Phishing Simulation, and Dark Web Monitoring. Zac and Michael discuss the importance of tool development, use of non-standards command and control protocols, and finish with a story covering ICMP command and control shells to bypass NextGen firewalls.
Episode Summary
In Episode 9 of War Stories, host Zac Davis talks with Michael Sviben, who helped shape Zac's own red team and reporting skills and now works at DomainGuard, an external threat visibility platform. They talk about building your own tools, nonstandard command and control channels, and the engagement where a ping-based shell slipped past a next-generation firewall.
Michael started at Camden County College in Blackwood, New Jersey, took his first IT job supporting the maritime industry on the waterfront, and earned his cybersecurity degree at Drexel University while working full time. His first security role involved deploying data loss prevention, web, and email proxy tools before he moved into penetration testing and red teaming. Asked for a favorite tool, he says the right answer is whatever fits the scenario, and that building or modifying tools is part of the tradecraft.
His war story comes from a spear phishing engagement where the team's command and control bot could not call out because of the client's proxy settings. Michael turned to an ICMP shell, a tool written years earlier that tunnels commands over ping traffic, reworked its C code in the lab, and tried it against the client. Their Palo Alto firewall allowed outbound ICMP, and the ping shell became the only channel that worked.
In This Episode
- Michael Sviben's path from Camden County College and Drexel University into offensive security
- External threat visibility: domain monitoring, takedowns, dark web monitoring, and attack surface monitoring
- Why tool development and modification are part of red team tradecraft
- Command and control (C2) over nonstandard protocols
- Using an ICMP shell to bypass a next-generation firewall during a phishing engagement
Would Your Firewall Catch a Ping Shell?
Outbound filtering is often weaker than inbound rules. SEVN-X runs red team engagements and penetration tests that test egress controls, phishing defenses, and detection the way real attackers would, and our dark web monitoring watches for exposed credentials and impersonation. Talk with our team about scoping a test for your organization.
