Corelight
Black Hat USA 2025: A grab bag and a half
From plaintext chat leaks to unencrypted SIP and LLM jailbreaks, the Black Hat USA 2025 NOC saw it all.
Corelight Bright Ideas Blog
This is the Custom Rich Text module
Feel free to edit this text to reflect your unique voice and message. Tell visitors what you do, why you do it, and what sets you apart.
- All
- Zeek
- Network Security Monitoring
- network security
- featured
- NDR
- network detection response
- Corelight
- cybersecurity
- network traffic analysis
- network visibility
- Bro
- SOC
- Corelight Labs
- Richard Bejtlich
- Product
- SIEM
- open source
- Announcements
- threat hunting
- BlackHat
- Industry
- Suricata
- Splunk
- DNS
- PCAP
- TLS
- open source community
- Corelight Sensor
- NSM
- Partnership
- HTTP
- MITRE ATT&CK
- GitHub
- Incident response
- network evidence
- Zeek Logs
- encrypted traffic
- SSH
- microsoft
- encrypted traffic collection
- JSON
- Detection
- IDS
- NOC
- command and control
- encryption
- ja3
- AWS
- HTTPS
- SSL
Corelight
Hunting GTPDOOR: The case of the "Black Hat Positive"
Recapping our learnings from the Black Hat NOC, using packet captures and Zeek scripting to decode threat payloads.
Ben Reardon
Sep 29, 2025
Corelight
Back in the Black Hat NOC: A familiar mission, a new crew
What stood out this year was the sheer volume of insecure application traffic. Corelight uncovered an unsecured corporate messaging app leaking...
Blake Cahen
Sep 29, 2025
Corelight
Dispatch from Black Hat Asia 2025: To err is (still) human
Recapping findings from the Black Hat Asia 2025 NOC: location data, plain text logins, and self-hosted apps without TLS.
Mark Overholser
May 19, 2025
Corelight
Black Hat Asia 2025 NOC: Headfirst into the (Un)Known
Four days in the Black Hat Asia 2025 NOC showed me why the network is “the source of truth”—and why even powerful tools need smart tuning to cut...
Stan Kiefer
May 19, 2025
Network Security Monitoring
Thrown in the deep end: My first time hunting in the Black Hat NOC
Step into the Black Hat NOC as I recount my first experience with real-time threat hunting.
Matt Ellison
Jan 28, 2025
network security
Tales from the Black Hat NOC (USA 2024) - speed to detect SSHAMBLE
Recapping our learnings from the Network Operations Center (NOC) at Black Hat USA 2024. Using historical network logs to detect threats during the...
Ben Reardon
Nov 27, 2024
network security
Want better network visibility? Don't just go with the (net)flow
Learn how Corelight logs provide deep network visibility for incident response and threat hunting in the Black Hat NOC.
Mark Overholser
Sep 23, 2024
NDR
Black Hat NOC: Zero Trust…but Verify | Corelight
Our experience in the Black Hat NOC has made us into adherents for “Zero Trust…but verify.”
Mark Overholser
Jul 8, 2024
network traffic analysis
Black Hat NOC: Findings from Europe & thoughts for Asia 2024
See how we used Corelight's Open NDR platform to take an evidence-based security approach at Blackhat Europe 2023.
Dustin Lee
Apr 5, 2024