{"id":1108,"date":"2025-12-26T20:39:00","date_gmt":"2025-12-26T20:39:00","guid":{"rendered":"https:\/\/zombierollz.blog\/?p=1108"},"modified":"2025-12-26T17:55:10","modified_gmt":"2025-12-26T17:55:10","slug":"aoc-2025-day-22-c2-detection-command-carol","status":"publish","type":"post","link":"https:\/\/zombierollz.blog\/?p=1108","title":{"rendered":"AoC 2025 – Day 22 – C2 Detection – Command & Carol"},"content":{"rendered":"\n

https:\/\/tryhackme.com\/room\/detecting-c2-with-rita-aoc2025-m9n2b5v8c1
Room created: tryhackme, Dex01, Gensane<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Per THM, “Packet capture (PCAP) is a networking practice involving the interception of data packets travelling over a network. Once the packets are captured, they can be stored by IT teams for further analysis. The inspection of these packets allows IT teams to identify issues and solve network problems affecting daily operations.

Zeek (formerly Bro) is the world’s leading platform for network security monitoring. Flexible, open source, and powered by defenders.”

THM has us run a few commands to turn the pcap files into structured logs.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Next we are tasked with importing these logs into RITA.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n

At this point, you will need to go full screen if you haven’t. I always like to keep split open as well so you can read and look at the VM at the same time if possible and are not required to do too much back in forth between tabs. THM instructs us to navigate the RITA utility with \/ to start a search and ? to look at various search fields.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Now we are tasked with looking at another pcap file: ~\/pcaps\/rita_challenge.pcap through the same steps as before. Remember: Don’t match everything with what THM had us do earlier; you will need to change a few things.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n

“How many hosts are communicating with\u00a0malhare.net<\/strong>?”<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

“Which Threat Modifier tells us the number of hosts communicating to a certain destination?”<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

What is the highest number of connections to\u00a0rabbithole.malhare.net<\/strong>?<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

“Which search filter would you use to search for all entries that communicate to\u00a0rabbithole.malhare.net<\/strong>\u00a0with a\u00a0beacon score<\/strong>\u00a0greater than 70% and sorted by\u00a0connection duration (descending)<\/strong>?”

This question is not as bad as it seems if you go by the Search Examples within RITA.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n

‘Which port did the host 10.0.0.13 use to connect to\u00a0rabbithole.malhare.net<\/strong>?’<\/p>\n\n\n\n

\"\"<\/figure>\n","protected":false},"excerpt":{"rendered":"

https:\/\/tryhackme.com\/room\/detecting-c2-with-rita-aoc2025-m9n2b5v8c1Room created: tryhackme, Dex01, Gensane Per THM, “Packet capture (PCAP) is a networking practice involving the interception of data packets travelling over a network. Once the packets are captured, they can be stored by IT teams for further analysis. The inspection of these packets allows IT teams to identify issues and solve network problems affecting […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-1108","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"blocksy_meta":{"styles_descriptor":{"styles":{"desktop":"","tablet":"","mobile":""},"google_fonts":[],"version":8}},"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/zombierollz.blog\/index.php?rest_route=\/wp\/v2\/posts\/1108","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/zombierollz.blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/zombierollz.blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/zombierollz.blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/zombierollz.blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1108"}],"version-history":[{"count":5,"href":"https:\/\/zombierollz.blog\/index.php?rest_route=\/wp\/v2\/posts\/1108\/revisions"}],"predecessor-version":[{"id":1129,"href":"https:\/\/zombierollz.blog\/index.php?rest_route=\/wp\/v2\/posts\/1108\/revisions\/1129"}],"wp:attachment":[{"href":"https:\/\/zombierollz.blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1108"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/zombierollz.blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1108"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/zombierollz.blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1108"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}