Erik Hjelmvik
NETRESEC Network Security Blog

Pony using curl to set: Accept-Encoding: identity, *;q=0

Detecting the Pony Trojan with RegEx using CapLoader

| | Accept-Encoding, curl, EmergingThreats, ids, Malware, malware-traffic-analysis.net, pony, quality factor, regex, regular expressions, rfc2616, rfc7231, snort, Suricata, trojan, video, videotutorial
This short video demonstrates how you can search through PCAP files with regular expressions (regex) using CapLoader and how this can be leveraged in order to improve IDS signatures. Your browser does not support the video tag. The EmergingThreats snort/suricata rule mentioned in the video is SID 20[...] ... Read More
NETRESEC Network Security Blog
CapLoader 1.7 logo

CapLoader 1.7 Released

| | CapLoader, domain name, dynamic protocol detection, GRE, ICMPv6, IGMP, IP, keyword, OSINT, pcap, regex, Regular expression
We are happy to announce the release of CapLoader 1.7! Here's an overview of what's new in this release: Regular expression searchingLookup of IP addresses using online servicesLookup of domain names using online servicesImproved protocol fingerprinting speed and precisionSupport for GRE, IGMP and I[...] ... Read More
NETRESEC Network Security Blog
SNMP Community Strings in NetworkMiner's Credential tab

NetworkMiner 2.3 Released!

| | A-LAW, ALAW, audio, Community strings, extract, G.711, G711, Hybrid Analysis, Netresec, Network Forensics, NetworkMiner, OSINT, pcap, RTP, SIP, smtp, SNMP, u-lAW, uLAW, VoIP, WAV, μ-law
The free and open source network forensics tool NetworkMiner now comes with improved extraction of files and metadata from several protocols as well as a few GUI updates. But the biggest improvements for version 2.3 are in the commercial tool NetworkMiner Professional, which now supports VoIP call a[...] ... Read More
NETRESEC Network Security Blog
Facebook

Examining Malware Redirects with NetworkMiner Professional

| | Browsers, CVE-2012-0507, CVE-2014-0569, Malware, malware_traffic, Meadgive, Netresec, NetworkMiner, nsm, pcap, Professional, redirect chain, security bloggers network, Tutorial, video, videotutorial
This network forensics video tutorial covers analysis of a malware redirect chain, where a PC is infected through the RIG Exploit Kit. A PCAP file, from Brad Duncan's malware-traffic-analysis.net website, is opened in NetworkMiner Professional in order to follow a redirect chain via a couple of hack[...] ... Read More
NETRESEC Network Security Blog