Experimental Run Data for Evaluating the Detection Effectiveness of Network Monitoring Tools Against Modern Command-and-Control Frameworks

This dataset contains raw and derived artifacts for a controlled laboratory evaluation of Zeek, Suricata, Security Onion, and post-hoc RITA analysis against Empire and Sliver command-and-control traffic. The experiment comprises 48 automated runs across default and tuned sensor configurations, HTTP and HTTPS communication profiles, Windows and Linux victims, and three repetitions per condition. Artifacts include per-run metadata, Zeek logs, Suricata logs, Security Onion exports, selected packet captures, and derived summary tables used in the associated white paper.