I’ve created and released a Zeek package, zeek-notice-telegram. I’ll walk you through a simple example so you can write your own action.
CVE-2021-1675 is a vulnerability that targets the Windows Print Spooler service. Find out more about detecting the PrintNightmare vulnerability here.
In this blog we aim to provide a little insight into part of the lifecycle of Corelight Lab’s response to a critical HTTP vulnerability.
I highlight sections of the EO that federal agencies should study closely and offer my thoughts, drawing from more than 30 years of cybersecurity...
As we finished rolling out our v21 software release, I was reminded of when I’d first read the 2015 “100G Intrusion Detection” paper written at...
This package runs on Corelight Sensors and provides network traffic analysis (NTA) inferences on live RDP traffic.
I am excited to announce Corelight’s v21 release, which delivers dozens of powerful C2 detections, extends analyst visibility around RDP connections,...
We’re excited to announce that the Command and Control (C2) Collection is now available with today’s launch of version 21 of the Corelight software.
This blog will introduce a method of detecting the Pingback malware in which attackers often hide their communications in ping message payloads.