Entropy Trap part 2: Real-World Failures and Better Alternatives
- Three common attack patterns where entropy detection fails outright: TLS C2, living-off-the-land obfuscation, and cloud exfiltration.
- Better signals exist in all three cases. They require understanding protocol semantics, not just string randomness.
- The shift is from "this string looks random" to "this session behaves anomalously."
Part 1 covered why entropy-based detection is structurally weak as a primary signal. This part gets specific with three real attack patterns where entropy either fires on everything or misses the attack entirely – and what actually works instead.
Failure case 1: TLS C2
Cobalt Strike, Brute Ratel, and most modern post-exploitation frameworks run C2 over TLS. The traffic looks like normal HTTPS. Valid certificates. Plausible SNI.
Entropy on the SNI or certificate common name tells you basically nothing. "update.microsoft.com" and a random C2 domain both score low. "api.cloudflare.com" looks identical to "cdn.attackdomain.net" on string randomness.
The signals that actually matter are:
JA4 fingerprinting.The...
Copyright of this story solely belongs to hackernoon.com. To see the full text click HERE
