Improve this Query into TCPDump ``` http.request.method == "CONNECT" || ssl.handshake.type == 1 && frame.time_delta_displayed >= 1 ``` Resources: https://www.elastic.co/security-labs/identifying-beaconing-malware-using-elastic https://activecm.github.io/threat-hunting-labs/beacons/#RITA
Improve this Query into TCPDump
Resources:
https://www.elastic.co/security-labs/identifying-beaconing-malware-using-elastic
https://activecm.github.io/threat-hunting-labs/beacons/#RITA