command and control
How Can Kill Webs Change Security Thinking?
Learn how the kill web concept can be applied to cybersecurity, and how it addresses some of the concerns with the kill chain.
Corelight Bright Ideas Blog
This is the Custom Rich Text module
Feel free to edit this text to reflect your unique voice and message. Tell visitors what you do, why you do it, and what sets you apart.
- All
- Zeek
- Network Security Monitoring
- network security
- featured
- NDR
- network detection response
- Corelight
- cybersecurity
- network traffic analysis
- network visibility
- Bro
- SOC
- Corelight Labs
- Richard Bejtlich
- Product
- SIEM
- open source
- Announcements
- threat hunting
- BlackHat
- Industry
- Suricata
- Splunk
- DNS
- PCAP
- TLS
- open source community
- Corelight Sensor
- NSM
- Partnership
- HTTP
- MITRE ATT&CK
- GitHub
- Incident response
- network evidence
- Zeek Logs
- encrypted traffic
- SSH
- microsoft
- encrypted traffic collection
- JSON
- Detection
- IDS
- NOC
- command and control
- encryption
- ja3
- AWS
- HTTPS
- SSL
command and control
How Does the Kill Chain Apply to Network-Derived Evidence?
This article proposes ways that modern network-derived evidence applies to the kill chain.
Richard Bejtlich
Sep 12, 2023
network visibility
“Easy” button for cloud NDR visibility
Corelight's SaaS offering for AWS removes the heavy lift of managing a vital security tool but maintains visibility needed to keep cloud deployments...
Todd Morneau
Oct 18, 2022
network security
Corelight Investigator: Ready for Europe
Corelight Investigator platform is engaged in attestation for GDPR to support customer threat hunting and incident response operations across Europe.
Sara Shuman
Oct 4, 2022
Zeek
Detecting CVE-2022-30216: Windows Server Service Tampering
Corelight Labs reviewed a POC exploit for CVE-2022-30216 and wrote a Zeek-based detection and released the package on GitHub.
Tillson Galloway
Aug 9, 2022
Network Security Monitoring
The best cybersecurity defense is great evidence
Federal CTO Jean Schaffer explores how evidence - not data - is critical to speed defenders’ knowledge and response capabilities.
Jean Schaffer
Jul 19, 2022
network detection response
The evidence bank: leveraging security's most valuable asset
Organizations often implement a data collection strategy out of fear, collecting everything “just in case.” I challenge the assumption.
Bernard Brantley
Jun 30, 2022
Zeek
Enriching NDR logs with context
We show how enriching Zeek® logs with cloud and container context makes it faster to tie interesting activity to the container or cloud asset...
Stan Kiefer
Jun 2, 2022
Zeek
Detecting CVE-2022-23270 in PPTP
In this post Corelight Labs reviewed a proof of concept exploit for this vulnerability and wrote a Zeek-based detection for it.
Corelight Labs Team
May 26, 2022
network detection response
Corelight Investigator accelerates threat hunting
This morning we announced Corelight Investigator, an open NDR platform that enables security teams with next-level evidence. Here is how it works.
Nick Hunter
May 25, 2022