Core protocols like LDAP are often left unmonitored. See how Zeek's ldap_search and DNS logs expose injection canaries and confirm whether attacks...
Application layer infrastructure visibility in IaaS using a recent Log4Shell example.
The blog covers a third log4j detection method, this one focused on the second-stage download that happens after the first stage completes.
We recently discussed some methods for detecting the Log4j exploit, and we’ve developed another method that one running Zeek® or a Corelight sensor...
In previous projects, I’ve tackled some needle-in-haystack problems. From these efforts, several high-level themes have emerged.