Basics

Detecting long connections:

• https://www.blackhillsinfosec.com/detecting-long-connections-with-zeek-bro-and-rita/

Detecting beacons:

• https://www.activecountermeasures.com/threat-simulation-beacons

• https://www.blackhillsinfosec.com/detecting-malware-beacons-with-zeek-and-rita/

Detecting TLS C2:

• Certificate Issues: https://www.activecountermeasures.com/threat-simulation-certificate-issues/

• https://www.activecountermeasures.com/threat-simulation-client-signatures-tls-signature/

DNS:

• https://www.activecountermeasures.com/threat-simulation-dns/