Corelight Bright Ideas Blog

Featured

CVE-2026-70111: How Corelight uncovered a 0-Day affecting Microsoft Distributed File System

Corelight Labs found CVE-2026-70111 while fuzzing DFS APIs: A one-packet kernel crash that kills any affected Windows Server immediately.

Travis Green & Labs Team Oct 13, 2026

Stories by Deepali

NDR

Hunting Citrix NetScaler zero-days with Corelight: Part 2

Explore how existing Zeek logs can reveal suspicious NetScaler DTLS traffic associated with CVE-2026-88772, with practical searches and investigation...

Deepali Prasad, Corelight Labs, Senior Detection Engineer. Oct 9, 2026

research

Unmasking BitRAT's C2 over HTTPS

BitRAT hides its C2 over HTTPS, but a default SSL certificate gives it away. See how to detect it with Zeek, Suricata, and SIEM queries.

Deepali Prasad, Corelight Labs, Senior Detection Engineer. Jul 9, 2026

research

Identifying and detecting ScoutC2 malware

Learn how Corelight detects ScoutC2 malware using Zeek, SIEM queries, and Suricata rules for distinctive HTTP paths, methods, headers, and payload...

Deepali Prasad, Corelight Labs, Senior Detection Engineer. Jul 7, 2026

AI that shows its work for a defensible SOC

The CISO’s guide to building a Mythos-ready security program

Open NDR Platform

Corelight announces cloud enrichment for AWS, GCP, and Azure

The Corelight Partner Program

Corelight DefeNDRs

Network Detection & Response

Corelight Bright Ideas Blog

CVE-2026-70111: How Corelight uncovered a 0-Day affecting Microsoft Distributed File System

Stories by Deepali

Hunting Citrix NetScaler zero-days with Corelight: Part 2

Unmasking BitRAT's C2 over HTTPS

Identifying and detecting ScoutC2 malware

Have questions?

Sign up for our newsletter

We’re hiring!

Get in touch