This website uses cookies. By clicking Accept, you consent to the use of cookies. Click Here to learn more about how we use cookies.
Accept
Reject

NetWitness Community

  • Home
  • Products
    • NetWitness Platform
      • Advisories
      • Documentation
        • Platform Documentation
        • Known Issues
        • Security Fixes
        • Hardware Documentation
        • Threat Content
        • Unified Data Model
        • Videos
      • Downloads
      • Integrations
      • Knowledge Base
    • NetWitness Cloud SIEM
      • Advisories
      • Documentation
      • Knowledge Base
    • NetWitness Detect AI
      • Advisories
      • Documentation
      • Knowledge Base
    • NetWitness Investigator
    • NetWitness Orchestrator
      • Advisories
      • Documentation
      • Knowledge Base
      • Legacy NetWitness Orchestrator
        • Advisories
        • Documentation
  • Community
    • Blog
    • Discussions
    • Events
    • Idea Exchange
  • Support
    • Case Portal
      • Create New Case
      • View My Cases
      • View My Team's Cases
    • Community Support
      • Getting Started
      • News & Announcements
      • Community Support Forum
      • Community Support Articles
    • Product Life Cycle
    • Support Information
    • General Security Advisories
  • Training
    • Blog
    • Certification Program
    • Course Catalog
      • Netwitness XDR
      • EC-Council Training
    • New Product Readiness
    • On-Demand Subscriptions
    • Student Resources
    • Upcoming Events
    • Role-Based Training
  • Technology Partners
  • Trust Center
Sign InRegister Now
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
NetWitness Community Blog
Subscribe to the official NetWitness Community blog for information about new product features, industry insights, best practices, and more.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
  • NetWitness Community
  • Blog
  • Profiling Attackers Series

Profiling Attackers Series

LeeKirkpatrick
Valued Contributor LeeKirkpatrick Valued Contributor
Valued Contributor
Options
  • Subscribe to RSS Feed
  • Mark as New
  • Mark as Read
  • Bookmark
  • Subscribe
  • Printer Friendly Page
  • Report Inappropriate Content
‎2020-04-01 11:17 AM

I have recently been posting a number of blogs regarding the usage of the RSA NeWitness Platform to detect attackers within your environment. As the list of the blogs grow, it is becoming increasingly difficult to navigate through them easily. In order to combat this, this blog post will contain references to all other blog posts in the Profiling Attackers Series, and will be updated when new posts are made.

 

 

 

Command and Control
Using RSA NetWitness to Detect Command and Control: PoshC2
Detecting Command and Control in RSA NetWitness: PowerShell Empire
Detecting Command and Control in RSA NetWitness: Koadic
Detecting Command and Control in RSA NetWitness: Metasploit
Detecting Command and Control in RSA NetWitness: Cobalt Strike
https://community.rsa.com/community/products/netwitness/blog/2019/12/02/using-rsa-netwitness-to-detect-command-and-control-poshc2-v50 
https://community.rsa.com/community/products/netwitness/blog/2019/12/06/using-rsa-netwitness-to-detect-cc-weasel 
https://community.rsa.com/community/products/netwitness/blog/2019/12/18/using-rsa-netwitness-to-detect-cc-reversetcp-shell 
https://community.rsa.com/community/products/netwitness/blog/2019/12/20/using-rsa-netwitness-to-detect-cc-covenant (Guest Blogger: Chris Thomas)
Using the RSA NetWitness Platform to Detect C&C: goDoH
https://community.rsa.com/community/products/netwitness/blog/2020/01/10/detecting-dns-tunneling-in-rsa-netwitness-dns2tcp (Guest Blogger: Marco Faggian‌)
Throwback C2 Thursday
Using RSA NetWitness to Detect HTTP Asynchronous Reverse Shell (HARS)
https://community.rsa.com/community/products/netwitness/blog/2020/05/14/using-rsa-netwitness-to-detect-chaos-c2 

 

Lateral Movement
Detecting Lateral Movement in RSA NetWitness: WMI
Detecting Lateral Movement in RSA NetWitness: Winexe
Detecting Lateral Movement in RSA NetWitness: Smbexec
Using the RSA NetWitness Platform to Detect Lateral Movement: SCShell (DCE/RPC)

 

Persistence
Web Shells and RSA NetWitness
Web Shells and NetWitness Part 2
Web Shells and RSA NetWitness Part 3
Using RSA NetWitness to Detect Credential Harvesting: lsassy

 

 

RATs
https://community.rsa.com/community/products/netwitness/blog/2020/05/26/using-rsa-netwitness-to-detect-quasarrat 
Using RSA NetWitness to Detect Void-RAT

 

Special thanks to Rui Ataide for his support and guidance for these posts.

  • hunting
  • NetWitness
  • NW
  • NWP
  • RSA NetWitness
  • RSA NetWitness Platform
18 Likes
Share
1 Comment

You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.

  • Comment
Latest Articles
  • Hunting Misconfigured Web Applications
  • Examining APT27 and the HyperBro RAT
  • FirstWatch Threat Spotlight: DarkTortilla
  • Sliver C2 – Network and Endpoint Detection with NetWitness Platform
  • Configure Channel Filter Settings on Endpoint Windows Log Policy
  • NetWitness Platform XDR version 12.1 -- Threat-Centric Content Bundles
  • Phase II Content Hygiene Initiative Complete: EDR (Endpoint) Application Rule Hygiene Initiative
  • FirstWatch Threat Spotlight: BlackCat Ransomware
  • FirstWatch Spotlight: Cyclops Blink – Sandworm’s Newest Addition to The Arsenal
  • FirstWatch Threat Spotlight – Raspberry Robin
Labels
  • Announcements 58
  • Events 2
  • Features 9
  • Integrations 6
  • Resources 61
  • Tutorials 25
  • Use Cases 23
  • Videos 116
Powered by Khoros
  • Blog
  • Events
  • Discussions
  • Idea Exchange
  • Knowledge Base
  • Case Portal
  • Community Support
  • Product Life Cycle
  • Support Information
  • About the Community
  • Terms & Conditions
  • Privacy Statement
  • Acceptable Use Policy
  • Employee Login
© 2022 RSA Security LLC or its affiliates. All rights reserved.