Analysis of top non-HTTP/S threats

This report analyzes prevalent Remote Access Trojans that communicate over custom non-HTTP/S protocols, describing each family's C2 protocol format, encryption (RC4, AES, DES, XOR/SUB, TLS with custom certs), distinguishing packet/length patterns and heuristics for detection, and supplies Snort rules and Cloud IPS signatures to help detect and block these RATs in network environments.