Главная
Study mode:
on
1
Intro
2
Echo Request
3
SSH Tunnel
4
ICMP
5
White Cap
6
Blacklist
7
Whitelist
8
Justin Henderson
9
Long Requests
10
DNS Resolution
11
DNS Sales
12
DNS CAD
13
Server View
14
Client View
15
DNS
16
subdomains
17
bro
18
use case
19
oneliner
20
GMB
21
IDO
22
Raw UDP
23
Null DNS Records
24
Wrapup
Description:
Explore command and control (C2) channel identification techniques using Security Onion in this conference talk from Security Onion Conference 2016. Delve into Eric Conrad's presentation on leveraging Security Onion to detect various C2 communication methods, including Echo Request, SSH Tunnel, ICMP, and DNS-based techniques. Learn about whitelisting, blacklisting, and analyzing long requests, DNS resolution, and subdomain patterns. Gain insights into using Server View and Client View for effective C2 detection, and discover practical tips for identifying raw UDP and null DNS records. Enhance your network security skills with this comprehensive overview of C2 channel detection strategies.

C2 Phone Home - Leveraging Security Onion to Identify Command and Control Channels

Security Onion
Add to list
0:00 / 0:00