Detecting Malware Beacons With Zeek and RITA

This document is a tutorial on using RITA within the ADHD distribution to detect beaconing behavior in network traffic analyzed from Zeek (Bro) logs, contrasting RITA’s analytics engine with the AI Hunter commercial GUI. It demonstrates interpreting RITA’s HTML output on a lab PCAP (e.g., many consistent-interval connections from 10.234.234.100 to a DigitalOcean IP) and explains beacon indicators such as interval regularity, consistent data sizes, and jitter/dispersion, emphasizing that high-scoring beacons warrant investigation and can be filtered via whitelists.