Collaborate Disseminate
Probably once a week, I see posts like this in the r/Ubiquiti subreddit. Ubiquiti makes network gear that includes an “IDS/IPS” feature. I own some older Ubiquiti gear so I am familiar with the product.When you enable this feature, you get alerts like … Continue reading What Are Normal Users Supposed to Do with IDS Alerts from Network Gear?
I wrote this on 7 December 2018 but never published it until today. The following are the “key network questions” which “would answer many key questions about [a] network, without having to access a third party log repository. This data is derive… Continue reading Key Network Questions
Over the weekend I organized some old computing equipment. I found this beauty in one of my boxes. It’s a Netgear EN104TP hub. I’ve mentioned this device before, in this blog and my books. This sort of device was the last of the true hubs. In an … Continue reading The Humble Hub
This is a quick note to point blog readers to my Zeek in Action YouTube video series for the Zeek network security monitoring project. Each video addresses a topic that I think might be of interest to people trying to understand their network usin… Continue reading Zeek in Action Videos
This video shows how Cobalt Strike and Hancitor C2 traffic can be detected using CapLoader. Your browser does not support the video tag. I bet you’re going: 😱 OMG he’s analyzing Windows malware on a Windows PC!!! Relax, I know what I’m doing. I have al… Continue reading Detecting Cobalt Strike and Hancitor traffic in PCAP
I was investigating traffic in my home lab yesterday, and noticed that about 1% of the traffic was weird. Before I describe the weird, let me show you a normal frame for comparison’s sake.This is a normal frame with Ethernet II encapsulation. It begins… Continue reading Dissecting Weird Packets
I spent a chunk of the day troubleshooting a network security monitoring (NSM) problem. I thought I would share the problem and my investigation in the hopes that it might help others. The specifics are probably less important than the general approach… Continue reading Troubleshooting NSM Virtualization Problems with Linux and VirtualBox
Yesterday I posted about DetectionLab, but noted that I was having trouble with the RDP servers offered by Virtualbox. If you remember, DetectionLab builds four virtual machines:root@LAPTOP-HT4TGVCP C:\Users\root>”c:\Program Files\Oracle\VirtualBox\… Continue reading Fixing Virtualbox RDP Server with DetectionLab
Many security professionals run personal labs. Trying to create an environment that includes fairly modern Windows systems can be a challenge. In the age of “infrastructure as code,” there should be a simpler way to deploy systems in a repeatable, virt… Continue reading Trying DetectionLab
I have been associated with network security monitoring my entire cybersecurity career, so I am obviously biased towards network-centric security strategies and technologies. I also work for a network security monitoring company (Corelight), but I am n… Continue reading Have Network, Need Network Security Monitoring