'Re: [Bro] Detecting remote powershell'

[prev in list] [next in list] [prev in thread] [next in thread] 

List:       bro
Subject:    Re: [Bro] Detecting remote powershell
From:       James Lay <jlay () slave-tothe-box ! net>
Date:       2018-03-16 23:05:49
Message-ID: 1521241549.2397.1.camel () slave-tothe-box ! net
[Download RAW message or body]

[Attachment #2 (multipart/alternative)]

Thanks Anthony...as luck would have it I'd already installed it on all
my sensors so I'll dig a little deeper into leveraging JA3 on the
detection side...thanks again.
James
On Fri, 2018-03-16 at 17:03 -0600, anthony kasza wrote:
> If you do some baselining in your environment, JA3 can be very
> successful at detecting Powershell.
> 
> -AK
> 
> On Mar 16, 2018 2:13 PM, "Seth Hall" <seth@corelight.com> wrote:
> > 
> > 
> > On 16 Mar 2018, at 13:46, James Lay wrote:
> > 
> > > YAY
> > 
> > Whew.  Everytime I see stuff like that I start getting nervous.
> > 
> >   .Seth
> > 
> > --
> > Seth Hall * Corelight, Inc * www.corelight.com
> > _______________________________________________
> > Bro mailing list
> > bro@bro-ids.org
> > http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro
> > 
[Attachment #5 (text/html)]

<html><head></head><body bgcolor="#ffffff" text="#4c4c4c" link="#8793c1" \
vlink="#8793c1"><div>Thanks Anthony...as luck would have it I'd already installed it \
on all my sensors so I'll dig a little deeper into leveraging JA3 on the detection \
side...thanks again.</div><div><br></div><div>James</div><div><br></div><div>On Fri, \
2018-03-16 at 17:03 -0600, anthony kasza wrote:</div><blockquote type="cite"><div \
dir="auto">If you do some baselining in your environment, JA3 can be very successful \
at detecting Powershell.<div dir="auto"><br></div><div dir="auto">-AK</div></div><div \
class="gmail_extra"><br><div class="gmail_quote">On Mar 16, 2018 2:13 PM, "Seth Hall" \
&lt;<a href="mailto:seth@corelight.com">seth@corelight.com</a>&gt; wrote:<br \
type="attribution"><blockquote type="cite"><br> <br>
On 16 Mar 2018, at 13:46, James Lay wrote:<br>
<br>
&gt; YAY<br>
<br>
Whew.&nbsp; Everytime I see stuff like that I start getting nervous.<br>
<br>
&nbsp; .Seth<br>
<br>
--<br>
Seth Hall * Corelight, Inc * <a href="http://www.corelight.com" rel="noreferrer" \
target="_blank">www.corelight.com</a><br> \
______________________________<wbr>_________________<br> Bro mailing list<br>
<a href="mailto:bro@bro-ids.org">bro@bro-ids.org</a><br>
<a href="http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro" rel="noreferrer" \
target="_blank">http://mailman.ICSI.Berkeley.<wbr>EDU/mailman/listinfo/bro</a><br> \
<br></blockquote></div></div> </blockquote></body></html>

_______________________________________________
Bro mailing list
bro@bro-ids.org
http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro

[prev in list] [next in list] [prev in thread] [next in thread] 