Corelight Bright Ideas Blog: NDR & Threat Hunting Blog

No PoCs? No problem. How to hunt for F5 exploitation even when details are sparse

By David Burkett – October 28, 2025

Endpoint detection and response (EDR) tools, and the analysts using them, have become incredibly effective. They have become so good, in fact, that we're now seeing a clear shift in adversary behavior: attackers are being pushed off the endpoint and... Read more »

Together is faster: Zeek for vulnerabilities

By Gregory Bell – August 17, 2020

“There is an open approach that is currently rippling across the infosec industry that could give defenders the acceleration they need.” – John Lambert (Distinguished Engineer, Microsoft) Read more »

Zeek in its sweet spot: Detecting F5’s Big-IP CVE10 (CVE-2020-5902)

By Ben Reardon – July 27, 2020

Having a CVE 10 unauthenticated Remote Code Execution vulnerability on a central load balancing device? That’s bad… Read more »