Which RITA threat hunting functionality is used to identify C2 activity specific to Meterpreter?

Meterpreter payloads maintain persistent, long-duration TCP connections back to a C2 handler rather than making frequent short requests. RITA (Real Intelligence Threat Analytics) analyzes network flow data and scores connections by duration and beaconing regularity, making long-lived connection analysis the primary method for identifying Meterpreter sessions.

Reviewing visited DNS subdomains targets C2 techniques that use domain generation algorithms (DGA) or DNS tunneling, not Meterpreter's direct TCP-based communication channel.

Analyzing gratuitous ARP packets is used to detect ARP spoofing or man-in-the-middle attacks on a local network segment, which is unrelated to identifying C2 beacon traffic.

IOC matching alerts on known static indicators like IP addresses or file hashes and does not detect Meterpreter's behavioral pattern of maintaining an unusually long-lived TCP session.