Collaborate Disseminate
An increasing number of malware families employ SSL/TLS encryption in order to evade detection by Network Intrusion Detection Systems (NIDS). In this blog post I’m gonna have a look at Adwind, which is a cross-platform Remote Access Trojan (RAT) that h… Continue reading Hunting AdwindRAT with SSL Heuristics
NetworkMiner 2.2 is faster, better and stronger than ever before! The PCAP parsing speed has more than doubled and even more details are now extracted from analyzed packet capture files. The improved parsing speed of NetworkMiner 2.2 can be enjoyed reg… Continue reading NetworkMiner 2.2 Released
We are today happy to announce the release of CapLoader 1.5. This new version of CapLoader parses pcap and pcap-ng files even faster than before and comes with new features, such as a built-in TCP stream reassembly engine, as well as support for Linux … Continue reading CapLoader 1.5 Released
I will come back to the awesome TROOPERS conference in Germany this spring to teach my two-day network forensics class on March 20-21. The training will touch upon topics relevant for law enforcement as well as incident response, such as investigating … Continue reading Network Forensics Training at TROOPERS 2017
Have you ever wanted to go back in time to get a PCAP of something strange that just happened on a PC? I sure have, many times, which is why we are now releasing a new tool called PacketCache. PacketCache maintains a hive of the most important and rece… Continue reading PacketCache lets you Go Back in Time