Threat Hunting with RITA: A Behavioral Analysis of C2 Traffic
A practical approach to finding covert command and control channels in network telemetry, using connection duration, beaconing cadence and network prevalence rather than signatures.
Hermon Kidane
Defensive Analyst
Defensive analyst working endpoint threat detection, alert triage and incident response, and detection engineering. Came up through network threat hunting with Zeek and RITA, and working toward malware analysis and reverse engineering.
Latest Research
View all postsSpeaking
Research Focus
Endpoint threat detection · Alert triage and investigation · Detection engineering · Malware analysis · Adversary tactics and procedures · Network traffic analysis · Zeek and RITA · Log analysis and correlation
About
This blog documents my research, analysis techniques, and lessons learned in defensive security: endpoint detection and detection engineering now, network threat hunting before that. Each post aims to be something a practitioner can actually use.
Get in touch