Markus Fors

logs, pcap and music

[𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 @netresec]

New tool released: #FlowCarp
🔍️Identifies protocols without port numbers
🔨 Build protocol detection from example traffic
➡️ Input: PCAP or PcapNG
⬅️ Output: Flows and/or Alerts
https://t.co/3sqnfOpN4a

[ET Labs @ET_Labs]

Started turning Suricata signatures into MIDI sequences for the sole reason of annoying my team members, I'll let you have a peek.

You are about to *listen* to this DNS signature.

Yours truly,
@ozuriexv

https://t.co/ajuTj4X5zS

[Markus Fors @mf0r3]

@chrissanders88 Vinyl, cassettes, VHS, Books, Comics 😅

[CYBER DOLPHIN🍁 @IamCyberDolphin]

#Cisco

@UK_Daniel_Card

[Keith J. Jones, Ph.D. @keithjjones]

A new @Zeekurity related video has hit the streets:

Industrial Control Systems (ICS) PCAP Resources For Zeek And Wireshark

https://t.co/J86S9G7DF8

[𝙽��𝚃𝚁𝙴𝚂𝙴𝙲 @netresec]

CapLoader now has an Alerts tab that identifies malicious protocols! It also alerts on typical C2 behavior, such as long running TCP sessions, periodic connections to a C2 server and port-protocol mismatches. Video and PCAP file available in the blog post.
https://t.co/6pna6ar29k

[Markus Fors @mf0r3]

@underallkritik Johnny Bode

[Markus Fors @mf0r3]

@addelindh Phoebe Bridgers - Sidelines förtjänar helt klart att stå högst upp på den listan

[𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 @netresec]

NetworkMiner is now available in FLARE VM thanks to @m_r_tz and @MalwareMechanic

[Chris Sanders 🔎 🧠 @chrissanders88]

At a fundamental level, the world exists in two forms. It exists as it is, and it exists as we perceive it. It's critically important for those with an investigative mindset to understand that those two things are often not the same at all.

[Markus Fors @mf0r3]

@underallkritik Du jobbar på HR med rekrytering

[Markus Fors @mf0r3]

@leifnixon Det är @Cultpix1 du behöver!

[𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 @netresec]

How to decode SOCKS traffic from #IcedID’s BackConnect C2 protocol with #Wireshark:
1⃣ Decode TCP 8080 as SOCKS
2⃣ Ignore packets matching tcp.payload[0:5]==4a:01:4f:97:04
3⃣ Display filter: socks.dst
https://t.co/Gc6MPwM5or

[Stef Rand @techieStef]

!!!!
IBM surveyed 1,100 IR team members across 10 companies about stress & well-being, and shared the results. I cannot tell you how neat this is. I'm fairly sure this is some of the first published info on stress in in-the-trenches infosec folks. SO HYPE.
https://t.co/FtzpsqWAym

[Markus Fors @mf0r3]

@dansarie @leifnixon https://t.co/Avdz07tkVP :)

[Markus Fors @mf0r3]

@addelindh Favoritkanal på youtube just nu https://t.co/PDQA4yaBS6

[Keith J. Jones, Ph.D. @keithjjones]

Detect #CVE-2022-26937, a vulnerability in MS's NFS, with @Zeekurity:

https://t.co/oaHk1sRRY2

#opensource #cybersecurity
@corelight_inc

[𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 @netresec]

There’s a little known feature in #Wireshark that allows a PCAP stream to be read from a TCP socket. This can be used to read decrypted TLS traffic directly from #PolarProxy.
https://t.co/UM7LXkmNy8

[Markus Fors @mf0r3]

@addelindh 🔥

[Markus Fors @mf0r3]

@addelindh Snyggaste Fendern 🤘🏼