Honeypot Diaries: Masscan

This blog post is the second installment of a series I want to use to cover lessons learned and interesting observations from my honeypots. These honeypots are geographically dispersed and have been running for a few years. Hopefully, this and future posts will add some value for someone. While looking over some of my honeypot … Read more

Ingesting PCAP Files with Zeek and Splunk

Whenever I want to analyze a relatively small packet capture (PCAP), I load it up in Wireshark and get the job done. However, this process does not scale and becomes a problem with large-sized pcap files. Even if you split, let’s say, a 25 terabyte PCAP up into smaller chunks, can you imagine how long it would … Read more

Detecting Tor communication

TorĀ (The Onion Router) is an internet communication network built on privacy and anonymity. Much of the attention that Tor receives comes from the malicious segment of users that leverage the Tor network to conduct attacks while concealing their location. This negative association and challenge in attribution have led most organizations to block traffic coming from … Read more

Blue Team Tactics: Honey Tokens Pt. I

If you are defending an enterprise network, you should be using some form of honey token or canary, which is just something you place in your environment that no one should access. If any interaction is detected, it is usually an indicator of unauthorized activity. Using pseudo domain accounts as honey tokens usually illuminate the risk bubble … Read more