Thanks to Brad Duncan for sharing this Qakbot pcap!
https://www.malware-traffic-analysis.net/2021/05/21/index2.html
We did a quick analysis of this pcap on the latest version of Security Onion via so-import-pcap:
https://docs.securityonion.net/en/2.3/so-import-pcap.html
Here are some of the interesting Suricata alerts, Zeek logs, and session transcripts:
No comments:
Post a Comment