BitRAT
Unmasking BitRAT's C2 over HTTPS
BitRAT hides its C2 over HTTPS, but a default SSL certificate gives it away. See how to detect it with Zeek, Suricata, and SIEM queries.
Featured
Hunting Citrix NetScaler Zero-Days with Corelight
Learn how to use Zeek logs and Corelight Investigator to discover Citrix NetScaler assets, monitor DTLS traffic, and hunt for zero-day exploitation...