Basics

Detecting long connections: 
​https://www.blackhillsinfosec.com/detecting-long-connections-with-zeek-bro-and-rita/​
Detecting beacons: 
​https://www.activecountermeasures.com/threat-simulation-beacons​
​https://www.blackhillsinfosec.com/detecting-malware-beacons-with-zeek-and-rita/​
Detecting TLS C2:
Certificate Issues: https://www.activecountermeasures.com/threat-simulation-certificate-issues/​
​https://www.activecountermeasures.com/threat-simulation-client-signatures-tls-signature/​
DNS:
​https://www.activecountermeasures.com/threat-simulation-dns/​
​
Last modified 2yr ago