trailofbits / sinter

A user-mode application authorization system for MacOS written in Swift
https://blog.trailofbits.com/2020/08/12/sinter-new-user-mode-security-enforcement-for-macos/
GNU Affero General Public License v3.0
301 stars 15 forks source link

Implement detection of C2 (C&C) channels #32

Closed mike-myers-tob closed 4 years ago

mike-myers-tob commented 4 years ago

(C&C: Command & Control, as in, remotely controlled malware)

Feasibility of this is unclear, but the desire is to detect:

How would network activity even be characterized as C2? Periodicity, unusualness, pattern-of-life time-of-day heuristics? Would any of this metadata analysis be better done with a Network Security Monitor?