Corelight Bright Ideas Blog

Featured

CVE-2026-70111: How Corelight uncovered a 0-Day affecting Microsoft Distributed File System

Corelight Labs found CVE-2026-70111 while fuzzing DFS APIs: A one-packet kernel crash that kills any affected Windows Server immediately.

Travis Green & Labs Team Oct 13, 2026

All
featured
Zeek
Network Security Monitoring
NDR
network security
SOC
Corelight
network detection response
cybersecurity
network traffic analysis
threat hunting
Bro
network visibility
Corelight Labs
Richard Bejtlich
SIEM
Product
open source
Announcements
research
Suricata
BlackHat
Corelight Sensor
Splunk
AI
DNS
Industry
PCAP
TLS
open source community
NSM
Partnership
HTTP
MITRE ATT&CK
GitHub
Incident response
Zeek Logs
encrypted traffic
microsoft
network evidence
SSH
encrypted traffic collection
threat hunter
Crowdstrike
Detection
IDS
JSON
command and control
encryption
ja3

NDR

Hunting Citrix NetScaler zero-days with Corelight: Part 2

Explore how existing Zeek logs can reveal suspicious NetScaler DTLS traffic associated with CVE-2026-88772, with practical searches and investigation...

Deepali Prasad, Corelight Labs, Senior Detection Engineer. Oct 9, 2026

Zeek

Hunting Citrix NetScaler zero-days with Corelight

Learn how to use Zeek logs and Corelight Investigator to discover Citrix NetScaler assets, monitor DTLS traffic, and hunt for zero-day exploitation...

Ben Reardon : Corelight Labs, Lead Security Researcher Sep 28, 2026