How I Detected Merlin QUIC C2 Traffic Using Entropy and Z-Scores (490K Packets, 0% False Positives) (opens in new tab)

This is the story of ThreatFade — a detection engine I built and validated against real C2 malware traffic. The core idea is that adversaries who go quiet are just as detectable as adversaries who shout, if you're measuring the right thing. The problem nobody talks about Every detection rule I've ever seen is built around presence. Something happens — a malicious domain resolves, a known signature matches, a payload crosses the wire — and the alert fires. But sophisticated C2 frameworks don't...