Incident Response and Forensics – Page 2

Threat Detection and Incident Response BLUE TEAM DETECT

Analysis with Wireshark

TShark VS. Wireshark (Terminal vs. GUI) TShark is a purpose-built terminal tool based on Wireshark. TShark shares many of the same features that are included in Wireshark and even shares syntax and options. TShark is perfect…

Bharath Narayanasamy wireshark

Threat Detection and Incident Response

Incident Report Template

Elements of an incident report Source: Hack The Box Incident Report Template

Bharath Narayanasamy Incident_Response, IR

CyBER Tools

Code Obfuscation and Deobfuscation

Code Obfuscation is a technique used to make a script more difficult to read by humans but allows it to function the same from a technical point of view, though performance may be slower. This is…

Bharath Narayanasamy dfir, Code

DETECT DFIR

Wireshark 101 | Traffic Analysis and Investigation (PART 02)

Identifying Hosts When investigating a compromise or malware infection activity, a security analyst should know how to identify the hosts on the network apart from IP to MAC address match. One of the best methods is…

Bharath Narayanasamy wireshark

Threat Hunting Threat Intelligence

Threat Intelligence

Threat Intelligence Foundation: Threat Intelligence is the analysis of data and information using tools and techniques to generate meaningful patterns on how to mitigate against potential risks associated with existing or emerging threats targeting organisations, industries,…

Bharath Narayanasamy Threat Intel, URLScan.io

DFIR DETECT

Wireshark 101 | Traffic Analysis and Investigation (PART 03)

Investigate Tunnelling Traffic: ICMP and DNS Traffic tunnelling is (also known as "port forwarding") transferring the data/resources in a secure method to network segments and zones. It can be used for "internet to private networks" and "private networks…

zyberbkay wireshark, dfir

DETECT DFIR

Wireshark 101 | Traffic Analysis and Investigation (PART 04)

Encrypted Protocol Analysis: Decrypting HTTPS When investigating web traffic, analysts often run across encrypted traffic. This is caused by using the Hypertext Transfer Protocol Secure (HTTPS) protocol for enhanced security against spoofing, sniffing and intercepting attacks.…

Bharath Narayanasamy wireshark