PCAP ZEEK |
| 2023-02-12 | Jesse La Grew | PCAP Data Analysis with Zeek |
PCAP |
| 2025-01-30/a> | Guy Bruneau | PCAPs or It Didn't Happen: Exposing an Old Netgear Vulnerability Still Active in 2025 [Guest Diary] |
| 2024-12-26/a> | Jesse La Grew | Capturing Honeypot Data Beyond the Logs |
| 2023-03-28/a> | Jesse La Grew | Network Data Collector Placement Makes a Difference |
| 2023-02-12/a> | Jesse La Grew | PCAP Data Analysis with Zeek |
| 2023-01-02/a> | Xavier Mertens | NetworkMiner 2.8 Released |
| 2022-11-14/a> | Jesse La Grew | Extracting 'HTTP CONNECT' Requests with Python |
| 2022-11-02/a> | Brad Duncan | Who put the "Dark" in DarkVNC? |
| 2021-12-22/a> | Brad Duncan | December 2021 Forensic Contest: Answers and Analysis |
| 2021-12-08/a> | Brad Duncan | December 2021 Forensic Challenge |
| 2021-11-04/a> | Brad Duncan | October 2021 Forensic Contest: Answers and Analysis |
| 2021-10-22/a> | Brad Duncan | October 2021 Contest: Forensic Challenge |
| 2021-06-30/a> | Brad Duncan | June 2021 Forensic Contest: Answers and Analysis |
| 2021-06-17/a> | Daniel Wesemann | Network Forensics on Azure VMs (Part #1) |
| 2021-05-23/a> | Didier Stevens | Video: Making Sense Of Encrypted Cobalt Strike Traffic |
| 2021-05-19/a> | Brad Duncan | May 2021 Forensic Contest: Answers and Analysis |
| 2021-05-05/a> | Brad Duncan | May 2021 Forensic Contest |
| 2021-04-18/a> | Didier Stevens | Decoding Cobalt Strike Traffic |
| 2021-04-12/a> | Didier Stevens | Example of Cleartext Cobalt Strike Traffic (Thanks Brad) |
| 2021-04-01/a> | Brad Duncan | April 2021 Forensic Quiz |
| 2021-03-07/a> | Didier Stevens | PCAPs and Beacons |
| 2021-01-30/a> | Guy Bruneau | PacketSifter as Network Parsing and Telemetry Tool |
| 2021-01-05/a> | Johannes Ullrich | Netfox Detective: An Alternative Open-Source Packet Analysis Tool |
| 2020-12-03/a> | Brad Duncan | Traffic Analysis Quiz: Mr Natural |
| 2020-11-11/a> | Brad Duncan | Traffic Analysis Quiz: DESKTOP-FX23IK5 |
| 2020-09-15/a> | Brad Duncan | Traffic Analysis Quiz: Oh No... Another Infection! |
| 2020-08-05/a> | Brad Duncan | Traffic Analysis Quiz: What's the Malware From This Infection? |
| 2020-07-15/a> | Brad Duncan | Word docs with macros for IcedID (Bokbot) |
| 2020-05-20/a> | Brad Duncan | Microsoft Word document with malicious macro pushes IcedID (Bokbot) |
| 2020-04-08/a> | Brad Duncan | German malspam pushes ZLoader malware |
| 2020-04-01/a> | Brad Duncan | Qakbot malspam sent from an infected Windows host |
| 2020-01-05/a> | Didier Stevens | etl2pcapng: Convert .etl Capture Files To .pcapng Format |
| 2019-12-24/a> | Brad Duncan | Malspam with links to Word docs pushes IcedID (Bokbot) |
| 2019-12-03/a> | Brad Duncan | Ursnif infection with Dridex |
| 2019-11-27/a> | Brad Duncan | Finding an Agent Tesla malware sample |
| 2019-10-29/a> | Xavier Mertens | Generating PCAP Files from YAML |
| 2019-10-09/a> | Brad Duncan | What data does Vidar malware steal from an infected host? |
| 2019-10-03/a> | Jim Clausing | Buffer overflows found in libpcap and tcpdump |
| 2019-05-22/a> | Johannes Ullrich | An Update on the Microsoft Windows RDP "Bluekeep" Vulnerability (CVE-2019-0708) [now with pcaps] |
| 2019-03-18/a> | Didier Stevens | Wireshark 3.0.0 and Npcap: Some Remarks |
| 2019-03-11/a> | Didier Stevens | Wireshark 3.0.0 and Npcap |
| 2018-11-18/a> | Guy Bruneau | Multipurpose PCAP Analysis Tool |
| 2018-08-15/a> | Xavier Mertens | Truncating Payloads and Anonymizing PCAP files |
| 2018-06-06/a> | Xavier Mertens | Converting PCAP Web Traffic to Apache Log |
| 2018-01-18/a> | Xavier Mertens | Comment your Packet Captures! |
| 2017-09-28/a> | Xavier Mertens | The easy way to analyze huge amounts of PCAP data |
| 2017-05-26/a> | Lorna Hutcheson | File2pcap - A new tool for your toolkit! |
| 2017-01-28/a> | Lorna Hutcheson | Packet Analysis - Where do you start? |
| 2014-06-04/a> | Richard Porter | p0f, Got Packets? |
| 2013-12-01/a> | Richard Porter | BPF, PCAP, Binary, hex, why they matter? |
| 2013-06-05/a> | Richard Porter | Wireshark 1.10.0 Stable Released http://www.wireshark.org/download.html |
| 2011-10-23/a> | Guy Bruneau | tcpdump and IPv6 |
| 2010-07-04/a> | Manuel Humberto Santander Pelaez | New Winpcap Version |
| 2010-03-27/a> | Guy Bruneau | Create a Summary of IP Addresses from PCAP Files using Unix Tools |
| 2009-11-25/a> | Jim Clausing | Updates to my GREM Gold scripts and a new script |
| 2009-08-13/a> | Jim Clausing | Tools for extracting files from pcaps |
| 2009-06-28/a> | Guy Bruneau | IP Address Range Search with libpcap |
ZEEK |
| 2025-02-13/a> | Guy Bruneau | DShield SIEM Docker Updates |
| 2024-11-26/a> | Jesse La Grew | [Guest Diary] Using Zeek, Snort, and Grafana to Detect Crypto Mining Malware |
| 2023-03-28/a> | Jesse La Grew | Network Data Collector Placement Makes a Difference |
| 2023-02-12/a> | Jesse La Grew | PCAP Data Analysis with Zeek |
| 2022-02-03/a> | Johannes Ullrich | Keeping Track of Your Attack Surface for Cheap |
| 2021-04-10/a> | Guy Bruneau | Building an IDS Sensor with Suricata & Zeek with Logs to ELK |
