Hunting C2 beaconing with Zeek and RITA
Template post. Replace this text with your write-up. Keep the structure: context, method, findings, detections, references.
Context
What problem were you solving, and in what kind of environment? Sanitize anything that identifies a client, site or internal IP range.
Method
Lab setup, data sources and the steps you took.
zeek -r capture.pcap local
rita import --logs ./zeek_logs --database lab_hunt
rita view lab_hunt
Findings
| Indicator | Score | Notes |
|---|---|---|
10.0.0.5 → 203.0.113.7 |
0.92 | Regular 60s interval, consistent size |
Detections
Rules, queries or hunt hypotheses others can reuse.