Detecting Long Connections With Zeek/Bro and RITA

A tutorial demonstrates using Active Countermeasures’ RITA on the ADHD VM to identify DNS-based command-and-control (e.g., DNScat2) by detecting massive volumes of randomized subdomain queries (e.g., nanobotninjas.com) in Bro/Zeek DNS logs and RITA reports, including practical use of zgrep for compressed logs, while warning that such traffic often traverses Google’s 8.8.8.8—frequently whitelisted by organizations—reducing detection.