Hancitor

Services tab in CapLoader

Detecting Cobalt Strike and Hancitor traffic in PCAP

| | 1768.py, CapLoader, Cobalt Strike, CobaltStrike, Hancitor, Netresec, nsm, pcap, periodicity, PIPI, Protocol Identification, video, videotutorial, Windows Sandbox
This video shows how Cobalt Strike and Hancitor C2 traffic can be detected using CapLoader. Your browser does not support the video tag. I bet you're going: 😱 OMG he's analyzing Windows ...
NETRESEC Network Security Blog