Uncovering the eMudhra incident: A Zeek detection
Use our Zeek package to detect the affected eMudhra certificates, since devices that don’t automatically get updates remain vulnerable.
Corelight Labs
Research
From detecting attacks to profiling behavior, Corelight Labs creates new ways to deepen network insight and strengthen enterprise security. We work in close partnership with other innovators at Corelight, and we take pride in the robust, deeply technical capabilities we create.
Latest from Corelight Labs
Building “php2shell” detections before coordinated disclosure
CVE-2026-70111: How Corelight uncovered a 0-Day affecting Microsoft Distributed File System
Read the blogUncovering the eMudhra incident: A Zeek detection
Blogs from Corelight Labs
Building “php2shell” detections before coordinated disclosure
We built Zeek and Suricata detections for php2shell, two serious remote code execution vulnerabilities in PHP, and released them as open source.
Ben Reardon : Corelight Labs, Lead Security Researcher
Oct 21, 2026
CVE-2026-70111: How Corelight uncovered a 0-Day affecting Microsoft Distributed File System
Corelight Labs found CVE-2026-70111 while fuzzing DFS APIs: A one-packet kernel crash that kills any affected Windows Server immediately.
Travis Green & Labs Team
Oct 13, 2026
Hunting Citrix NetScaler zero-days with Corelight: Part 2
Explore how existing Zeek logs can reveal suspicious NetScaler DTLS traffic associated with CVE-2026-88772, with practical searches and investigation guidance.
Deepali Prasad, Corelight Labs, Senior Detection Engineer.
Oct 9, 2026
Hunting Citrix NetScaler zero-days with Corelight
Learn how to use Zeek logs and Corelight Investigator to discover Citrix NetScaler assets, monitor DTLS traffic, and hunt for zero-day exploitation indicators.
Ben Reardon : Corelight Labs, Lead Security Researcher
Sep 28, 2026
When the fuzzers come knocking on port 389: Hunting injection canaries in LDAP
Core protocols like LDAP are often left unmonitored. See how Zeek's ldap_search and DNS logs expose injection canaries and confirm whether attacks worked.
Ben Reardon : Corelight Labs, Lead Security Researcher
Sep 11, 2026
The Cure for Exceptional Zeek Package Testing (Part 3)
Learn how to test Zeek packages without PCAPs by using Zeek logs and the Input Framework to reproduce bugs, analyze historical data, and prevent regressions.
Yacin Nadji
Aug 18, 2026
The Cure for Exceptional Zeek Package Testing (Part 2)
Learn how to test Zeek packages without shareable PCAPs by hand-crafting BTest events and using Zeek event traces to reliably reproduce network activity.
Yacin Nadji
Aug 18, 2026
The Cure for Exceptional Zeek Package Testing (Part 1)
Learn how to unit test Zeek packages with BTest and assert statements, using practical examples to catch failures and build more reliable Zeek scripts.
Yacin Nadji
Aug 18, 2026
Evaluating AI systems at Corelight
Learn how Corelight Labs evaluates AI systems for network detection using custom harnesses, LLM-as-judge methods, and curated security datasets.
Ujwala Bhagavatula and Mei Lam, Corelight Labs
Aug 17, 2026
What a music trivia game at Black Hat Asia revealed about network visibility
See how a Black Hat music trivia game exposed unencrypted traffic, weak validation, and the value of network visibility.
Nacho Arnaldo
Jul 15, 2026
Unmasking BitRAT's C2 over HTTPS
BitRAT hides its C2 over HTTPS, but a default SSL certificate gives it away. See how to detect it with Zeek, Suricata, and SIEM queries.
Deepali Prasad, Corelight Labs, Senior Detection Engineer.
Jul 9, 2026
Identifying and detecting ScoutC2 malware
Learn how Corelight detects ScoutC2 malware using Zeek, SIEM queries, and Suricata rules for distinctive HTTP paths, methods, headers, and payload patterns.
Deepali Prasad, Corelight Labs, Senior Detection Engineer.
Jul 7, 2026
Black Hat Asia 2026: Everything from cat feeders to solar farms
At Black Hat Asia, everyday IoT devices exposed authentication tokens and credentials over cleartext HTTP, showing what the network sees but endpoints miss.
Ben Reardon : Corelight Labs, Lead Security Researcher
Jun 10, 2026
Black Hat Europe 2025: Threat Hunting With Agentic AI
At Black Hat Europe 2025, we used agentic AI to autonomously decode messy traffic and uncover sensitive leaks that standard hunts missed.
Nacho Arnaldo
Feb 27, 2026
Recent research
Network Detection of Interactive SSH Impostors Using Deep Learning
Impostors who have stolen a user's SSH login credentials can inflict significant harm to the systems to which the user has remote access. We consider the problem of identifying such imposters when they conduct interactive SSH logins by detecting discrepancies in the timing and sizes of the client-side data packets, which generally reflect the typing dynamics of the person sending keystrokes over the connection.
Recent research
GGFAST: Automating Generation of Flexible Network Traffic Classifiers
When employing supervised machine learning to analyze network traffic, the heart of the task often lies in developing effective features for the ML to leverage. We develop GGFAST, a unified, automated framework that can build powerful classifiers for specific network traffic analysis tasks, built on interpretable features. The framework uses only packet sizes, directionality, and sequencing, facilitating analysis in a payload-agnostic fashion that remains applicable in the presence of encryption.
To learn more about Corelight Labs, contact our team.