Lion Cipher Lab
Hunt C2 beaconing in your Zeek logs with RITA
- Threat Intel Analyst
- Intermediate
- ~60 min
- Free · no account required
Why it matters
A lot of real intrusions are quiet. Once malware lands, it usually has to check in with its operator to receive commands or hand back data, and it often does that on a timer — every 60 seconds, every 5 minutes, every hour — a pattern defenders call beaconing. A human browsing the web is bursty and irregular; an automated implant calling home is boringly regular, and that regularity is something you can measure. RITA does exactly that: it reads Zeek's connection logs and scores how beacon-like each internal-to-external conversation is, so a single machine can surface the handful of connections…
What you'll learn
- understanding what C2 beaconing is
- installing RITA
- importing Zeek logs into RITA (rita import)
- reading the beacon score and hunting with rita view
- distinguishing a lead from a verdict
- mapping findings to MITRE ATT&CK C2 techniques
Steps in this lab
- What C2 beaconing actually is
- What RITA is and how it fits with Zeek
- Generate Zeek logs from traffic you own
- Install RITA
- Import your Zeek logs into RITA
- Read the beacon score
- The honest caveat: a lead, not a verdict
- Why timing-based hunting is worth your reps