AfterImage: Evading Traditional Indicator of Compromise (IOC) Blocking

Malicious IP address blocking is a fundamental aspect of cybersecurity operations, and is used by security operators to decelerate the progress of network and host intrusions. From an intruders' standpoint, current methods to bypass IP address blocking typically involve setting up network proxies manually each time an existing IP address is detected and blocked. To automate this highly manual process, we propose AfterImage, an anti-forensics solution to automate the switching between multiple web proxies, thus simplifying the process of evading IP address blocking and logging defenses. Designed for local and remote deployment, AfterImage further includes the ability for automated discovery of usable, public web proxies through web scraping. By automating the setup of public-use proxies, AfterImage increases the efficiency of dissociating IP addresses during security testing. Our testing demonstrates the capacity for AfterImage to reestablish broken sessions over multiple proxies, as well as reliability of source IP concealment within redirected packets.