A NETWORK THREAT HUNTER'S GUIDE TO C2 OVER QUIC

Summary from the TLDR InfoSec newsletter

QUIC is a newer network communication protocol that abbreviates the typical TCP 3-way handshake as well as adding other features such as a Communication ID for persistent connections. This post introduces the QUIC protocol and then sets up a lab environment to analyze the Merlin QUIC-based C2 with different sets of delays. The post finds that the Merlin C2 can be detected by RITA with any delay, alternatively, Zeek logs can be examined for unusually persistent QUIC connections, and finally, the post also noted a unique QUIC handshake that is only exhibited by Merlin.