NetWitness Community

In Incident Response we often get called in to customer engagements after an incident has occurred (yeah, I know, that is why it is called Response). Unfortunately, not all organisations we work with have centralised log collection … or if they do, t...

To round out our series explaining how to use the indicators from ASD & NSA's report for detecting web shells (Detect and prevent web shell malware | Cyber.gov.au ) with NetWitness, let's take a look at the endpoint focused indicators. If you missed ...

Following on from my last post that focused on analysing web server logs https://community.rsa.com/community/products/netwitness/blog/2020/04/30/detecting-webshells-with-web-server-logs , this time we are going to look at the network based indicators...

IntroductionThe Australian Signals Directorate (ASD) & US National Security Agency (NSA) have jointly released a useful guide for detecting and preventing web shell malware. If you haven't seen it yet, you can find it here:Detect and prevent web shel...

IntroductionHaving recently moved into the IR team – where I now have to actually do stuff as opposed to just talking about stuff in technical sales – I have found that the best way to get up to speed with detecting attacker behaviours is to run the ...