command and control
How Can Kill Webs Change Security Thinking?
Learn how the kill web concept can be applied to cybersecurity, and how it addresses some of the concerns with the kill chain.
Corelight Bright Ideas Blog
This is the Custom Rich Text module
Feel free to edit this text to reflect your unique voice and message. Tell visitors what you do, why you do it, and what sets you apart.
- All
- Zeek
- Network Security Monitoring
- network security
- featured
- NDR
- network detection response
- Corelight
- cybersecurity
- network traffic analysis
- network visibility
- Bro
- SOC
- Corelight Labs
- Richard Bejtlich
- Product
- SIEM
- open source
- Announcements
- threat hunting
- BlackHat
- Industry
- Suricata
- Splunk
- DNS
- PCAP
- TLS
- open source community
- Corelight Sensor
- NSM
- Partnership
- HTTP
- MITRE ATT&CK
- GitHub
- Incident response
- network evidence
- Zeek Logs
- encrypted traffic
- SSH
- microsoft
- encrypted traffic collection
- JSON
- Detection
- IDS
- NOC
- command and control
- encryption
- ja3
- AWS
- HTTPS
- SSL
command and control
How Does the Kill Chain Apply to Network-Derived Evidence?
This article proposes ways that modern network-derived evidence applies to the kill chain.
Richard Bejtlich
Sep 12, 2023
Zeek
Key takeaways from RSA 2023: #BetterTogether and AI in security
Whether or not you made it to RSA 2023, check out this blog to learn about key themes from this year’s conference.
Ed Smith
May 8, 2023
Zeek
New Sliver C2 Detection Released - Redteam detected
Corelight announces the release of a new detection package “Sliver”, which identifies and raises alerts related to the Sliver C2 framework.
Corelight Labs Team
May 4, 2023
Corelight Labs
Corelight Sensors detect the ChaChi RAT
Recently Blackberry analyzed a new GoLang Remote Access Trojan (RAT) named “ChaChi.” Here's how Corelight Sensors can detect the ChaChi RAT.
Corelight Labs Team
Jun 25, 2021
Corelight Labs
Corelight Sensors detect the ChaChi RAT
Recently Blackberry analyzed a new GoLang Remote Access Trojan (RAT) named “ChaChi.” Here's how Corelight Sensors can detect the ChaChi RAT.
Corelight Labs Team
Jun 24, 2021
Zeek
World’s first 100G Zeek sensor
As we finished rolling out our v21 software release, I was reminded of when I’d first read the 2015 “100G Intrusion Detection” paper written at...
Sarah Banks
May 24, 2021
network detection response
How do you know?
Can you be sure attackers aren’t hiding in your encrypted traffic? It’s a fundamental question in enterprise security. Why? Imagine these two shops.
Charles Strauss
May 18, 2021
Zeek
C2 detections, RDP insights and NDR at 100G
I am excited to announce Corelight’s v21 release, which delivers dozens of powerful C2 detections, extends analyst visibility around RDP connections,...
John Gamble
May 18, 2021
Zeek
Introducing the C2 Collection and RDP inferences
We’re excited to announce that the Command and Control (C2) Collection is now available with today’s launch of version 21 of the Corelight software.
Vince Stoffer
May 18, 2021