#FullPacketCapture - Twitter Hashtag

4 days ago

Explore how Vehere is solving some of cyber defense's toughest challenges: https://t.co/8Zz0rPTHac #Cybersecurity #Innovation #Patents #ResearchAndDevelopment #NDR #NetworkDetectionandResponse #FullPacketCapture #LawfulInterception #COMINT #SIGINT #CyberResilience

Vehere_Inc's tweet photo. Explore how Vehere is solving some of cyber defense's toughest challenges: https://t.co/8Zz0rPTHac

#Cybersecurity #Innovation #Patents #ResearchAndDevelopment #NDR #NetworkDetectionandResponse #FullPacketCapture #LawfulInterception #COMINT #SIGINT #CyberResilience https://t.co/Imbsp8mQfI

0

6

Security Onion

@securityonion

about 4 years ago

@malware_traffic A fun part of this analysis was: - reviewing #VNC alerts and pivoting to #FullPacketCapture - searching for connections with unknown protocols and pivoting to #PCAP to see it's #VNC traffic (that's one way to hunt for this kind of traffic even if we didn't have the #NIDS alerts)

securityonion's tweet photo. @malware_traffic A fun part of this analysis was:
- reviewing #VNC alerts and pivoting to #FullPacketCapture
- searching for connections with unknown protocols and pivoting to #PCAP to see it's #VNC traffic (that's one way to hunt for this kind of traffic even if we didn't have the #NIDS alerts) https://t.co/OmhrHVowMu

0

7

4

0

Security Onion

@securityonion

about 4 years ago

@malware_traffic A fun part of this analysis was: - finding #Suricata #NIDS alert for "Base64 Encoded potential malware" - pivoting to #FullPacketCapture - sending the stream to #CyberChef and applying recipes to strip HTTP headers, dechunk HTTP response, and decode #Base64 - extract #malware EXE

securityonion's tweet photo. @malware_traffic A fun part of this analysis was:
- finding #Suricata #NIDS alert for "Base64 Encoded potential malware"
- pivoting to #FullPacketCapture
- sending the stream to #CyberChef and applying recipes to strip HTTP headers, dechunk HTTP response, and decode #Base64
- extract #malware EXE https://t.co/WBVeDa2TXk

0

6

5

1

0

Security Onion

@securityonion

about 4 years ago

@malware_traffic A fun part of this exercise was: - reviewing #Hancitor checkin alerts - pivoting to #FullPacketCapture - finding #base64 encoded POST - decoding #base64 using #CyberChef and finding username, domain, and IP information

securityonion's tweet photo. @malware_traffic A fun part of this exercise was:
- reviewing #Hancitor checkin alerts
- pivoting to #FullPacketCapture
- finding #base64 encoded POST
- decoding #base64 using #CyberChef and finding username, domain, and IP information https://t.co/gWOR5eK4Ah

0

13

4

1

0

alfromvan @alfromvan

about 7 years ago

At #BCNET2019 conference Neil Wyler @grifter801 making some compelling insights on Threat Hunting and Incident Response. #RSA #fullpacketcapture have a #huntingmindset.