Incident response

2020 NIST ransomware recovery guide: What you need to know

Introduction Over the past decade, a destructive piece of malware has grown from a novel concept into a digital epidemic. Now ransomware is causing a serious

Incident response

Network traffic analysis for IR: Data exfiltration

Introduction Understanding network behavior is a prerequisite for developing effective incident detection and response capabilities. ESG research has found

Incident response

Network traffic analysis for IR: Basic protocols in networking

Introduction In this article, we’ll discuss some of the basic protocols that are commonly used in computer networking. A good understanding of computer netw

Incident response

Network traffic analysis for IR: Introduction to networking

Introduction Computer networking is one of the most important skills that incident responders are required to have. Analyzing network traffic as an incident

Incident response

Network Traffic Analysis for IR — Discovering RATs

Introduction A Remote Access Trojan (RAT) is part of the malware family. It enables covert surveillance, a backdoor channel and unfettered and unauthorized

Incident response

Network traffic analysis for IR: Analyzing IoT attacks

Introduction The Internet of Things (IoT) incorporates everything from tiny sensors and devices to huge structures like cloud computing. IoT includes the ma

Incident response

Network traffic analysis for IR: TFTP with Wireshark

The Trivial File Transfer Protocol (TFTP) is designed to provide a bare-bones method of sending data from a server to a client. Its main use is for firmware

Incident response

Network traffic analysis for IR: SSH protocol with Wireshark

SSH protocol The Secure Shell (SSH) is designed to allow confidential and authenticated remote access to a computer. Like the Telnet protocol, it enables a

Incident response

Network traffic analysis for IR: Analyzing DDoS attacks

Introduction Distributed Denial-of-Service (DDoS) attacks are one of the powerful cyber weapons threat actors use today. We often hear about a website being

Incident response

Wireshark for incident response 101

Wireshark is a freely available tool for network traffic analysis. It can be used to either analyze saved packet capture files or perform live traffic captur