Listen to this Post
When working in defensive cybersecurity, SOC, or incident response, understanding the tools used is crucial. Here’s a breakdown of key tools categorized by their purpose:
🔍 Network Analysis
- Wireshark: Inspect raw traffic (packets, protocols, anomalies).
- pfSense: Open-source firewall for filtering, routing, and segmentation.
- Snort: Signature-based network intrusion detection.
- Arkime: Index and search network captures (PCAP).
🧠 OS & Memory Analysis
- Volatility: Analyze memory dumps for suspicious behavior.
- osquery: Query system data using SQL (processes, connections, etc.).
- Wazuh: Host monitoring + event correlation.
- OSSEC: Lightweight HIDS engine.
- HELK: Hunting environment based on ELK + detection tools.
- RegRipper: Parse and extract Windows registry data.
🚨 Incident Management
- TheHive: Incident tracking and management platform.
- GRR Rapid Response: Remote forensic response (automated collection).
🎯 Threat Intelligence
- MISP: Manage and share IoCs (Indicators of Compromise).
- MSTICPY: Python-friendly threat enrichment and investigation.
🪤 Honeypots
- Cowrie/Kippo: SSH emulation to capture intrusion attempts.
- Dockpot: Containerized multi-service honeypot.
- HonSSH: SSH proxy to observe live commands.
🛡️ EDR / SIEM
- Wazuh + ELK: Open-source monitoring + correlation stack.
- Cortex XDR, FortiEDR: Commercial EDR solutions.
- Splunk, LogRhythm, OSSIM: SIEM for log collection and analysis.
You Should Know:
🔧 Practical Commands & Steps
1. Wireshark Packet Analysis
Capture traffic on eth0 and save to file sudo tshark -i eth0 -w capture.pcap Filter HTTP traffic wireshark -Y "http" -r capture.pcap
2. Volatility Memory Forensics
List running processes volatility -f memory.dump --profile=Win10x64 pslist Extract suspicious DLLs volatility -f memory.dump --profile=Win10x64 dlllist -p <PID>
3. osquery for System Monitoring
Check active network connections osqueryi "SELECT FROM process_open_sockets;" List installed software osqueryi "SELECT name, version FROM programs;"
4. Snort for IDS
Run Snort in detection mode sudo snort -A console -q -c /etc/snort/snort.conf -i eth0
5. TheHive Incident Management
Create a new case via API
curl -XPOST -H "Authorization: Bearer YOUR_API_KEY" -H "Content-Type: application/json" -d '{"title":"Malware Alert","description":"Possible ransomware"}' http://thehive:9000/api/case
What Undercode Say:
A strong Blue Team relies on the right tools and automation. Wireshark and Volatility help dissect attacks, while SIEMs like Splunk and Wazuh provide real-time correlation. Honeypots like Cowrie deceive attackers, and MISP ensures threat intel sharing. Mastering these tools with hands-on practice—like analyzing PCAPs, memory dumps, and logs—sharpens defensive skills.
Expected Output:
Example Snort alert output [] [1:1000001:1] Suspicious HTTP Request [] [Priority: 1] 03/15-12:45:30.123456 192.168.1.100 -> 10.0.0.1 GET /malware.exe HTTP/1.1
For further reading:
References:
Reported By: Biren Bastien – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
