#pcap

Articles tagged with #pcap

Introducing Frame Bench: read, edit and build packet captures at the byte level
Read, edit, and build packet captures at the byte level: open one you have, or make one from nothing.
Oct 16, 202610 min read16
Detect ICMP-Ghost Implant ICMP and DNS Tunnelling C2 Traffic Using PacketSmith Yara-X & ICMP Detection Modules
Introduction ICMP-Ghost is an open-source tunnelling framework written in pure x64 assembly. What stands out about this framework, compared to other closed- and open-source ones, is the author's claim
Aug 14, 202612 min read150
Detecting Exploitation of CrushFTP Vulnerability (CVE-2025-31161) With PacketSmith Yara Detection Module - Using track_state and flow_state
Introduction This vulnerability was found by Outpost24 under the identifier CVE-2025-31161 (previously reported as CVE-2025-2825). Outpost24 and other vendors and security researchers have shared enou
May 14, 20268 min read200
Detect Shulfar Malware Encrypted TCP C&C Traffic Using PacketSmith Yara-X Detection Module
Introduction Splunk published a blog post about a variant of the Gh0stRat malware family used in a new campaign delivered alongside the CloverPlus adware. The blog post is titled "Not Just Annoying Ad
Apr 24, 20267 min read966
Detect SnappyClient C&C Traffic Using PacketSmith + Yara-X Detection Module
Introduction Zscaler published a blog post about a new malware called SnappyClient, written in the C++ programming language. The malware communicates with its C&C server using a custom binary protocol
Mar 23, 20266 min read549
How to Apply VXLAN-GBP Encapsulation to PCAP Files Using PacketSmith
Introduction In version 5.1.0 (codenamed Taxus), released on March 16, 2026, the injection engine has undergone a significant evolution, transitioning from basic command-line parameters to a robust, t
Mar 16, 20263 min read150