NETRESEC - Network Forensics and Network Security Monitoring
LightNews LightNews
netresec.com.web.brid.gy
NETRESEC - Network Forensics and Network Security Monitoring
@netresec.com.web.brid.gy
8 followers 0 following 61 posts
Network forensics, packet sniffers and IT security products. Download NetworkMiner and other free software for network security analysis.

[bridged from https://netresec.com/ on the web: https://fed.brid.gy/web/netresec.com ]
Posts Replies Media Videos
netresec.com.web.brid.gy
Optimizing IOC Retention Time
Are you importing indicators of compromise (IOC) in the form of domain names and IP addresses into your SIEM, NDR or IDS? If so, have you considered for how long you should keep looking for those IOCs? An IoT botnet study from 2022 found that 90% of C2 servers had a lifetime of less than 5 days and[...]
www.netresec.com
November 6, 2025 at 7:16 PM
netresec.com.web.brid.gy
Online Network Forensics Class
I will teach a live online network forensics training on February 23-26. The full title of the class is Network Forensics for Incident Response, where we will analyze PCAP files containing network traffic from hackers and malware. The training is split into four interactive sessions running from 13:[...]
www.netresec.com
October 30, 2025 at 7:09 PM
netresec.com.web.brid.gy
Gh0stKCP Protocol
Gh0stKCP is a transport protocol based on KCP, which runs on top of UDP. Gh0stKCP has been used to carry command-and-control (C2) traffic by malware families such as PseudoManuscrypt and ValleyRAT/Winos4.0. @Jane_0sint recently tweeted about ValleyRAT using a new UDP based C2 protocol. I wanted to t[...]
www.netresec.com
October 7, 2025 at 6:52 PM
netresec.com.web.brid.gy
Define Protocol from Traffic (XenoRAT)
This video shows how to define a protocol in CapLoader just by providing examples of what the protocol looks like. CapLoader can then identify that protocol in other traffic, regardless of IP address and port number, simply by looking for traffic that behaves similar to what it was trained on. We ca[...]
www.netresec.com
August 28, 2025 at 5:48 PM
netresec.com.web.brid.gy
PureRAT = ResolverRAT = PureHVNC
PureRAT is a Remote Access Trojan, which can be used by an attacker to remotely control someone else's PC. PureRAT provides the following features to an attacker: See the victims user interfaceInteract with the victim PC using mouse and keyboardView the webcamListen to the microphoneRecord keystroke[...]
www.netresec.com
August 19, 2025 at 5:23 PM
netresec.com.web.brid.gy
PureLogs Forensics
I analyzed some PureLogs Stealer malware infections this morning and found some interesting behavior and artifacts that I want to share. PureLogs infections sometimes start with a dropper/downloader that retrieves a .pdf file from a legitimate website. The dropper I will demo here downloaded this fi[...]
www.netresec.com
July 9, 2025 at 5:05 PM
netresec.com.web.brid.gy
CapLoader 2.0.1 Released
This update resolves several minor bugs, but also brings better protocol identification and a new IP lookup alert to CapLoader. Alert for IP lookup using ip-api.com in PCAP from tria.ge Transcript of ip-api.com IP lookup traffic IP lookup services, like ip-api, checkip.amazonaws.com and ident.me, ar[...]
www.netresec.com
July 9, 2025 at 5:05 PM
netresec.com.web.brid.gy
Detecting PureLogs traffic with CapLoader
CapLoader includes a feature for Port Independent Protocol Identification (PIPI), which can detect which protocol is being used inside of TCP and UDP sessions without relying on the port number. In this video CapLoader identifies the C2 protocol used by the PureLogs Stealer malware. The PureLogs pro[...]
www.netresec.com
June 16, 2025 at 4:58 PM
netresec.com.web.brid.gy
CapLoader 2.0 Released
I am thrilled to announce the release of CapLoader 2.0 today! This major update includes a lot of new features, such as a QUIC parser, alerts for threat hunting and a feature that allow users to define their own protocol detections based on example network traffic. User Defined Protocols CapLoader's[...]
www.netresec.com
June 9, 2025 at 4:53 PM
netresec.com.web.brid.gy
Comparison of tools that extract files from PCAP
One of the premier features in NetworkMiner is the ability to extract files from captured network traffic in PCAP files. NetworkMiner reassembles the file contents by parsing protocols that are used to transfer files across a network. But there are other tools that also can extract files from PCAP f[...]
www.netresec.com
May 12, 2025 at 4:48 PM
netresec.com.web.brid.gy
Decoding njRAT traffic with NetworkMiner
I investigate network traffic from a Triage sandbox execution of njRAT in this video. The analysis is performed using NetworkMiner in Linux (REMnux to be specific). About njRAT / Bladabindi njRAT is a Remote Access Trojan (RAT) that can be used to remotely control a hacked computer. It has been arou[...]
www.netresec.com
May 5, 2025 at 4:56 PM
netresec.com.web.brid.gy
How to Install NetworkMiner in Linux
This guide shows how to install the latest version of NetworkMiner in Linux. To install an older NetworkMiner release, prior to version 3.0, please see our legacy NetworkMiner in Linux guide. STEP 1: Install Mono and GTK2Mono is an open source cross-platform implementation of the .NET framework, it[...]
www.netresec.com
April 17, 2025 at 4:53 PM
netresec.com.web.brid.gy
Online Network Forensics Training
I will teach a live online class next month. The subject for the class is Network Forensics for Incident Response. The training is split into four interactive 4-hour sessions, so that you have the rest of each work-day free to either practice what you learned in class or catch up with your 'normal'[...]
www.netresec.com
April 17, 2025 at 4:53 PM
netresec.com.web.brid.gy
NetworkMiner 3.0 Released
I am very proud to announce the release of NetworkMiner 3.0 today! This version brings several new protocols as well as user interface improvements to NetworkMiner. We have also made significant changes under the hood, such as altering the default location to where NetworkMiner extracts files from n[...]
www.netresec.com
April 17, 2025 at 4:53 PM
netresec.com.web.brid.gy
How to set PCAP as default save file format in Wireshark
Did you know that there is a setting in Wireshark for changing the default save file format from pcapng to pcap? In Wireshark, click Edit, Preferences. Then select Advanced and look for the capture.pcap_ng setting. Change the value to FALSE if you want Wireshark to save packets in the pcap file form[...]
www.netresec.com
March 10, 2025 at 4:38 PM
netresec.com.web.brid.gy
PolarProxy 1.0.1 Released
The new release of PolarProxy generates JA4 fingerprints and enables ruleset to match on specific decryption errors, for example to enable fail-open in case the TLS traffic cannot be decrypted and inspected. JA4 FingerprintsJA4 fingerprints provide several improvements over its JA3 predecessor. One[...]
www.netresec.com
February 14, 2025 at 4:33 PM
netresec.com.web.brid.gy
Blocking Malicious sites with a TLS Firewall
Over 90 percent of all web traffic is encrypted nowadays, which is great of course. However, as HTTP and DNS traffic gets encrypted, defenders have a more difficult time blocking malicious network traffic. One solution to this problem is to use a TLS firewall, which effectively blocks encrypted conn[...]
www.netresec.com
February 5, 2025 at 4:32 PM
netresec.com.web.brid.gy
VoIP tab in NetworkMiner Professional
The VoIP tab is a unique feature only available in NetworkMiner Professional. The analyzed PcapNG file comes from a blog post by Johannes Weber titled VoIP Captures. See our NetworkMiner Professional tutorial videos for more tips and hints.
www.netresec.com
January 29, 2025 at 4:04 PM
netresec.com.web.brid.gy
Browsers tab in NetworkMiner Professional
The Browsers tab is a unique feature only available in NetworkMiner Professional. The PCAP files analyzed in this video are pwned-se_150312_outgoing.pcap and pwned-se_150312_incoming.pcap, which are snippets of the 4.4 GB Hands-on Network Forensics dataset from FIRST 2015 (slides). More information[...]
www.netresec.com
January 29, 2025 at 4:04 PM
netresec.com.web.brid.gy
Files tab in NetworkMiner Professional
The PCAP file analyzed in this video is pwned-se_150312_outgoing.pcap, which is a snippet of the 4.4 GB Hands-on Network Forensics dataset from FIRST 2015 (slides). See our NetworkMiner Professional tutorial videos for more tips and hints.
www.netresec.com
January 29, 2025 at 4:04 PM
netresec.com.web.brid.gy
Hosts tab in NetworkMiner Professional
The PCAP file analyzed in this video is MD_2015-07-22_112601.pcap, which is a snippet of the training data used in our network forensics classes from 2015 to 2019. Techniques, tools and databases mentioned in the tutorial: CIDR notationSatorip0fmac-ages Check out our Passive OS Fingerprinting blog p[...]
www.netresec.com
January 29, 2025 at 4:04 PM
netresec.com.web.brid.gy
Opening capture files with NetworkMiner Professional
This video tutorial demonstrates how to open capture files with NetworkMiner Professional The analyzed pcap-ng file is github.pcapng from CloudShark. More info about this capture file can be found in our blog post Forensics of Chinese MITM on GitHub. See our NetworkMiner Professional tutorial videos[...]
www.netresec.com
January 29, 2025 at 4:04 PM
netresec.com.web.brid.gy
Video Tutorial: Installing NetworkMiner Professional
This video tutorial covers how to install NetworkMiner Professional. Use the official 7-zip tool to extract the password protected 7zip archive. Recommended locations for NetworkMiner: DesktopMy DocumentsC:\Users\{user}\AppData\Local\Programs\USB flash drive See our NetworkMiner Professional tutoria[...]
www.netresec.com
January 29, 2025 at 4:04 PM
netresec.com.web.brid.gy
CapLoader 1.9.7 Released
A new release of CapLoader has been published! Some of the changes can be seen directly in the user interface, such as Community ID values for flows and a few other new columns in the Flows and Services tabs. Other improvements are more subtle, like improved detection of remote management protocols[...]
www.netresec.com
January 29, 2025 at 4:04 PM