An In-Depth Study of Open-Source Command and Control Frameworks

Previous work has intensely studied the prevention and detection of malicious network traffic, but current solutions still lack the efficacy needed to detect Remote Access Trojan (RAT) network activity. This deficiency is becoming more of a threat with the releases of open-source implementations that emphasize ease of use while maintaining stealth and modularity. In this paper, we provide a detailed design and analysis of network-based methods that can detect generic RAT behaviors such as polling, and specific detection techniques targeting three popular open-source RATs: Metasploit, Empire, and Pupy. Our methods rely on passive monitoring as well as semi-active scans targeting suspicious servers that are triggered by the passive monitoring system. Our complete classification system achieves a ~98.5% true positive rate and a ~0.01% false positive rate, validating our approach to RAT detection.