WinRM

Finding SolarWinds / SUNBURST backdoors with Zeek, Suricata, & Corelight

Detecting CVE-2021-31166 – HTTP vulnerability

| | Accept-Encoding, Corelight Labs, CVE-202131166, GitHub, http, http.log, HTTP.sys, Network Security, network security monitoring, network traffic analysis, network visibility, SOAP, SolarWinds, SUNBURST, WinRM, Zeek
By Ben Reardon, Corelight Security Researcher In this blog we aim to provide a little insight into part of the lifecycle of Corelight Lab’s response to a critical HTTP vulnerability. We’ve open-sourced ...
Bright Ideas Blog
PacketCache logo

Remote Packet Dumps from PacketCache

| | free, Invoke-Command, Invoke-LiveResponse, Netresec, PacketCache, pcap, PowerForensics, powershell, PSRemoting, Remoting, TrustedHosts, Windows, WinRM
This blog post describes how to dump a packet capture (pcap file) on a remote computer, which runs the PacketCache service, and retrieve that pcap file using only PowerShell. PacketCache is a ...
NETRESEC Network Security Blog