The CyberSift Packet Capture Parser — Intro

One of the most frequent questions we get is how to extract information from a Wireshark packet capture, such as the bandwidth used:

Wireshark has various built in tools that help you to extract this information, however we…

Windows High Privilege User Monitoring

High Privilege Users (HPUs) are users in your Windows environment which have “blanket…

Detecting CVE-2022–30190 “Follina”

CyberSift has just pushed an update to it’s Windows Context Workers in order to detect attempts to exploit the CVE-2022–30190 “Follina” vulnerability. Follina abuses the the Microsoft Support Diagnostic Tool (MSDT) to allow an attacker remote code execution when a…

The CyberSift Packet Capture Parser — Threat Intelligence

Detecting Lateral Movement in Windows Environments

One of the anomaly detection algorithms deployed in CyberSift is the ability to detect abnormal login patterns which could indicate lateral movement. Referring to the new D3FEND MITRE framework, this defense would fall under:

The CyberSift Packet Capture Parser — DNS Queries

Keep up to date with our latest features

We’re launching a newsletter for our customers and the general public to keep up to…