The Wraith: Manifold-Based Command-and-Control Detection Through Involuntary Operating System Telemetry with Blind Dual-Layer Validation

Modern command-and-control (C2) implants employ encrypted channels, domain fronting, sleep obfuscation, and malleable communication profiles to evade
  signature-based and behavioral-rule-based detection systems. We observe that regardless of evasion sophistication, every C2 implant must interact with the host     
  operating system — creating threads, allocating memory, opening sockets, triggering context switches — and that these interactions produce measurable perturbations 
  in OS-level performance telemetry.                                                                                                                                 
                                                                                                                                                                      
  We formalize this observation as a manifold detection problem: under normal operation, the system's state vector traces trajectories on a learned manifold; C2
  activity forces the state off-manifold, producing a detectable distance. We propose The Wraith, a dual-layer detection framework comprising a supervised layer      
  trained on known C2 signatures and an unsupervised layer that learns the normal-behavior manifold from raw OS telemetry alone, with an information barrier ensuring
  zero cross-contamination between layers.                                                                                                                            
                                          
  We specify twelve OS-level metric dimensions capturable via Event Tracing for Windows (ETW) and extended Berkeley Packet Filter (eBPF), analyze their feasibility at
   sub-second resolution with overhead under 3% CPU, and propose a rigorous blind validation protocol using Cohen's kappa and permutation testing to determine whether
   unsupervised manifold-distance detection independently corroborates supervised C2 identification.                                                                  
                                                                                                                                                                      
  This paper contributes the mathematical formulation, a complete experimental design, and a falsifiable hypothesis. No experimental results are claimed. Empirical
  validation using Sliver, Cobalt Strike, Havoc, Mythic, Brute Ratel C4, and Merlin is planned for v2.