https://princessz3b0sec.dev/tags/rita/ Recent content in Rita on princessz3b0sec Hugo en-US Fri, 23 Oct 2026 00:00:00 +0000 https://princessz3b0sec.dev/research/beaconing-with-rita/ Fri, 23 Oct 2026 00:00:00 +0000 https://princessz3b0sec.dev/research/beaconing-with-rita/ <blockquote> <p><strong>Template post.</strong> Replace this text with your write-up. Keep the structure: context, method, findings, detections, references.</p> </blockquote> <h2 id="context">Context</h2> <p>What problem were you solving, and in what kind of environment? Sanitize anything that identifies a client, site or internal IP range.</p> <h2 id="method">Method</h2> <p>Lab setup, data sources and the steps you took.</p> <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl">zeek -r capture.pcap <span class="nb">local</span> </span></span><span class="line"><span class="cl">rita import --logs ./zeek_logs --database lab_hunt </span></span><span class="line"><span class="cl">rita view lab_hunt </span></span></code></pre></div><h2 id="findings">Findings</h2> <table> <thead> <tr> <th>Indicator</th> <th>Score</th> <th>Notes</th> </tr> </thead> <tbody> <tr> <td><code>10.0.0.5 → 203.0.113.7</code></td> <td>0.92</td> <td>Regular 60s interval, consistent size</td> </tr> </tbody> </table> <h2 id="detections">Detections</h2> <p>Rules, queries or hunt hypotheses others can reuse.</p>