-
2 months ago | 
securityboulevard.com | Daniel Kelley |Erik Hjelmvik |Vinugayathri Chinnasamy |Lucian Constantin
-
Oct 13, 2024 | 
blog.apnic.net | Erik Hjelmvik
Do you want to analyse decrypted TLS traffic in Wireshark or let an Intrusion Detection System (IDS), like Suricata, Snort or Zeek, inspect the application layer data of potentially malicious TLS encrypted traffic? There are many different TLS inspection solutions to choose from, but not all of them might be suitable for the specific challenge you’re facing. In this blog post, I describe three different methods for decrypting TLS and explain when to use one or the other.
-
Sep 6, 2024 | 
securityboulevard.com | Erik Hjelmvik
A new release of CapLoader has been published! Some of the changes can be seen directly in the user interface, such as Community ID values for flows and a few other new columns in the Flows and Services tabs. Other improvements are more subtle, like improved detection of remote management protocols and malicious C2 protocols.
-
Aug 7, 2024 | 
securityboulevard.com | Erik Hjelmvik
Do you want to analyze decrypted TLS traffic in Wireshark or let an IDS, like Suricata, Snort or Zeek, inspect the application layer data of potentially malicious TLS encrypted traffic? There are many different TLS inspection solutions to choose from, but not all of them might be suitable for the specific challenge you're facing. In this blog post I describe three different methods for decrypting TLS and explain when to use one or the other.
-
Aug 7, 2024 | 
securityboulevard.com | Erik Hjelmvik
By Erik Hjelmvik Do you want to analyze decrypted TLS traffic in Wireshark or let an IDS, like Suricata, Snort or Zeek, inspect the application layer data of potentially malicious TLS encrypted traffic? There are ...
-
Jul 19, 2024 | 
securityboulevard.com | Richi Jennings |Mike Vizard |Erik Hjelmvik
-
Jun 3, 2024 | 
securityboulevard.com | Erik Hjelmvik
I will teach two live online classes this autumn, one in October and one in November. The subject for both classes is network forensics for incident response. The training is split into four interactive morning sessions, so that you have the afternoon free to either practice what you learned in class or catch up with your "normal" day job. The number of attendees will be limited in order to provide a good environment for taking questions. A maximum of 15 attendees will be accepted per class.
-
May 28, 2024 | 
securityboulevard.com | Wajahat Raja |Erik Hjelmvik |Brian Krebs |Kelly Giles
Recent reports claim that the Microsoft Threat Intelligence team stated that a cybercriminal group, identified as Storm-1811, has been exploiting Microsoft's Quick Assist tool in a series of social engineering attacks. This ...
-
May 27, 2024 | 
securityboulevard.com | Erik Hjelmvik
NetworkMiner 2.9 brings several new and improved features to help analysts make sense of network traffic from malware, criminals and industrial control systems. Highlights from this new version include: TZSP support StealC extractor Improved Modbus parser JA4 support GTP decapsulationMalware Traffic Artifact Extraction NetworkMiner is a popular tool for extracting artifacts from malware traffic.
-
May 3, 2024 | 
securityboulevard.com | Mike Vizard |Ofri Ouzan |Erik Hjelmvik |David Harley
There may be persuasive reasons why providers are reluctant to engage directly with their customers, but the consequences may be grim for both provider and customer. (Plus links to stories about Nigerian ...
