Learn how to test Zeek packages without shareable PCAPs by hand-crafting BTest events and using Zeek event traces to reliably reproduce network...
Learn how to unit test Zeek packages with BTest and assert statements, using practical examples to catch failures and build more reliable Zeek...
Learn how Corelight Labs evaluates AI systems for network detection using custom harnesses, LLM-as-judge methods, and curated security datasets.
See how a Black Hat music trivia game exposed unencrypted traffic, weak validation, and the value of network visibility.
BitRAT hides its C2 over HTTPS, but a default SSL certificate gives it away. See how to detect it with Zeek, Suricata, and SIEM queries.
Learn how Corelight detects ScoutC2 malware using Zeek, SIEM queries, and Suricata rules for distinctive HTTP paths, methods, headers, and payload...
At Black Hat Asia, everyday IoT devices exposed authentication tokens and credentials over cleartext HTTP, showing what the network sees but...
At Black Hat Europe 2025, we used agentic AI to autonomously decode messy traffic and uncover sensitive leaks that standard hunts missed.
During Black Hat Europe 2025, I had the honor to join our team of “firefighters” at the Black Hat NOC and feel the heat for real.