Leveraging the blue team's endpoint protection as C2