NETRESEC Network Security Blog

Hunting for Cobalt Strike in PCAP

Jan 4

By Erik Hjelmvik

Network Forensics Training - Spring 2024

Dec 11

By Erik Hjelmvik

CapLoader 1.9.6 Released

Nov 15

By Erik Hjelmvik

Forensic Timeline of an IcedID Infection

Oct 12, 2023

By Erik Hjelmvik

NetworkMiner 2.8.1 Released

Oct 2, 2023

By Erik Hjelmvik

EvilExtractor Network Forensics

Apr 26, 2023

By Erik Hjelmvik

QakBot C2 Traffic

Mar 2, 2023

By Erik Hjelmvik

TLS Redirection and Dynamic Decryption Bypass in PolarProxy

Feb 28, 2023

By Erik Hjelmvik

How to Identify IcedID Network Traffic

Feb 15, 2023

By Erik Hjelmvik

CapLoader 1.9.5 Alerts on Malicious Traffic

Feb 9, 2023

By Erik Hjelmvik

Online Network Forensics Class

Jan 17, 2023

IEC-104 File Transfer Extraction

Jan 9, 2023

By Erik Hjelmvik

NetworkMiner 2.8 Released

Jan 2, 2023

By Erik Hjelmvik

NetworkMiner in FLARE VM

Dec 12, 2022

By Erik Hjelmvik

What is a PCAP file?

Oct 27, 2022

By Erik Hjelmvik

IcedID BackConnect Protocol

Oct 12, 2022

By Erik Hjelmvik

Hunting for C2 Traffic

Sep 30, 2022

By Erik Hjelmvik

What is PCAP over IP?

Aug 15, 2022

By Erik Hjelmvik

CapLoader 1.9.4 Released

Jun 16, 2022

By Erik Hjelmvik

Real-time PCAP-over-IP in Wireshark

May 24, 2022

By Erik Hjelmvik

NETRESEC - Network Forensics and Network Security Monitoring

Jul 3, 2015

NetworkMiner 2.7.3 Released

Apr 4, 2022

By Erik Hjelmvik

PolarProxy in Windows Sandbox

Jan 31, 2022

By Erik Hjelmvik

PolarProxy 0.9 Released

Jan 13, 2022

By Erik Hjelmvik

Open .ETL Files with NetworkMiner and CapLoader

Nov 2, 2021

By Erik Hjelmvik

How the SolarWinds Hack (almost) went Undetected

Oct 18, 2021

By Erik Hjelmvik

Start Menu Search Video

Sep 28, 2021

Carving Packets from Memory

Aug 31, 2021

By Erik Hjelmvik

Walkthrough of DFIR Madness PCAP

Jul 9, 2021

By Erik Hjelmvik

NetworkMiner 2.7 Released

Jun 15, 2021

By Erik Hjelmvik

Network Forensics Classes for EU and US

Jun 7, 2021

Detecting Cobalt Strike and Hancitor traffic in PCAP

May 31, 2021

By Erik Hjelmvik

CapLoader 1.9 Released

May 25, 2021

Running NetworkMiner in Windows Sandbox

May 11, 2021

By Erik Hjelmvik

Analysing a malware PCAP with IcedID and Cobalt Strike traffic

Apr 19, 2021

By Erik Hjelmvik

Targeting Process for the SolarWinds Backdoor

Feb 17, 2021

Twenty-three SUNBURST Targets Identified

Jan 25, 2021

Robust Indicators of Compromise for SUNBURST

Jan 11, 2021

Finding Targeted SUNBURST Victims with pDNS

Jan 4, 2021

Extracting Security Products from SUNBURST DNS Beacons

Dec 29, 2020

Reassembling Victim Domain Fragments from SUNBURST DNS

Dec 17, 2020

Capturing Decrypted TLS Traffic with Arkime

Dec 1, 2020

By Erik Hjelmvik

PolarProxy 0.8.16 Released

Nov 30, 2020

PolarProxy in Podman

Oct 27, 2020

By Erik Hjelmvik

Honeypot Network Forensics

Oct 21, 2020

By Erik Hjelmvik

PolarProxy in Docker

Oct 7, 2020

By Erik Hjelmvik

There are no items to show.

Search

Clear search

Close search

Google apps

Main menu