akde/infosec

Information security is ultimately about managing risk

Network Flow Data analysis

Use cases

Detection of connections to known bad servers
- If we detected a malware and know a C&C server, we can search through historical flow data to detect other possible infected systems.
Atipical data transfer volume
- Could lead to a data exfiltration.
Long living connections
- Often, this is an indicator for a C&C connection, which stays open for a very long time.

Standard unix tools like awk can also been used with a cat of a flow file.

You must be logged in to post a comment.

Personal collection of some infosec stuff. Primary purpose of this site is to collect and organize for myself.

Note: Some content is not publicly visible due to copyright issues. Therefore, some links could be broken.

python -c 'import pty;pty.spawn("/bin/bash")';

python3 -c 'import pty;pty.spawn("/bin/bash")';