Question about FQDN going away
kyleEeeEEeeee opened this issue · 5 comments
Hello,
Does the SNI module also grab http host names? I was tracking that the FQDN would pick up on a malicious C2 domain switching IP infrastructure. Does SNI cover this or is that a gap now?
Any Answer to this?
Hello, just checking in to see if there is an answer to this question?
Hello all, the SNI module grabs hostnames from the HTTP host header and the TLS server name indication.
If a C2 channel uses HTTP or TLS, the corresponding FQDN will pop up in the SNI module.
On the other hand, if a C2 channel is not using HTTP or TLS, RITA will not be able to track it as it bounces between IP addresses.
In practice, we find most C2 channels which bounce between IP addresses run with TLS enabled.
Great thanks! That's what we were hoping. We love RITA :)
Sorry for the lag time in responding to this. If you'd like to get a hold of us a bit quicker, please check out our Discord at https://discord.gg/threathunter