Just Enough Tradecraft: Rethinking C2 on Assumed Breaches

Skyler Knecht & Kevin Clark

Burning River Cyber Con

November 15, 2025

SlidesC2 · Red Team · Tradecraft

November 15, 2025

Slide deck

View inline above or open in a new tab for your browser's PDF viewer.

View in new tab Download PDF

Speaker

Skyler Knecht & Kevin Clark

SpecterOps / TrustedSec

Skyler Knecht is a Senior Security Consultant at SpecterOps. He performs security assessments for large organizations, focuses on initial access research, and contributes to open-source tooling and vulnerability research. Skyler has presented at conferences including DEF CON and BSides. Kevin Clark is a Security Consultant with TrustedSec and a Red Team Instructor. He has a background in software development, penetration testing, and offensive operations, and regularly delivers training and conference presentations.

Talk overview

Many red-team engagements use a full C2 implant by default. This presentation argues that for assumed-breach scenarios, a lighter operational footprint is often preferable: the presenters will show alternatives to deploying persistent implants, discuss trade-offs, and present operational workflows that accomplish objectives with less noisy tooling.

Share

Share this talk with your crew or on social.

Share on X Share on Bluesky