REDCAP-TOKEN Cookie Command and Control Artefact

Daniel Jeremiah@daniyyell

•updated Jun 19, 2026•0•0•1

Detects the campaign-specific REDCAP-TOKEN cookie name in available endpoint or network event metadata. GTIG reported that INFINITERED used this HTTP cookie to receive encrypted commands and return system, database, and configuration information. This query depends on the cookie value being retained in AdditionalFields by the available sensor or integrated telemetry source.