Mini-Module
Summary
The Threat Hunting for C2 with RITA module is designed for cybersecurity professionals, Threat hunters, and Network security analysts.
Throughout this module, students will develop advanced skills in identifying and mitigating Command and Control (C2) threats using RITA, acquire hands-on experience in proactive threat hunting within network environments, and enhanced expertise in analyzing and responding to C2 communication to strengthen overall cybersecurity defenses.
Recommended prior knowledge:
-
Basic understanding of cybersecurity concepts
-
Familiarity with network security
Introduction to RITA
In this module, we will discuss using RITA to hunt for malicious network anomalies.
RITA (Real Intelligence Threat Analytics) is an open-source tool used for network security analysis and threat detection. It collects, parses, and analyzes network traffic data, providing insight into network activity and allowing security professionals to detect and respond to security incidents. RITA provides real-time alerts and enables users to perform network forensics and incident response tasks. This tool is designed to be easily installed, used, and maintained, making it a popular choice for small- to medium-sized organizations.
This framework ingests with Zeek Logs in TSV format, and currently supports the following major features:
-
Beaconing Detection: Search for signs of beaconing behavior in and out of your network. -
DNS Tunneling Detection: Search for signs of DNS-based covert channels. -
Blacklist Checking: Query blacklists to search for suspicious domains and hosts. -
URL Length Analysis: Search for lengthy URLs indicative of malware. -
Scanning Detection: Search for signs of port scans in your network.