<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>Network Forensics Blog &#187; Network Forensics</title>
	<atom:link href="http://www.networkforensics.com/category/networkforensics/feed/" rel="self" type="application/rss+xml" />
	<link>http://www.networkforensics.com</link>
	<description></description>
	<lastBuildDate>Tue, 21 Jun 2011 22:54:21 +0000</lastBuildDate>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.1</generator>
	<div id='fb-root'></div>
					<script>
						window.fbAsyncInit = function()
						{
							FB.init({appId: null, status: true, cookie: true, xfbml: true});
						};
						(function()
						{
							var e = document.createElement('script'); e.async = true;
							e.src = document.location.protocol + '//connect.facebook.net/en_US/all.js';
							document.getElementById('fb-root').appendChild(e);
						}());
					</script>	
						<item>
		<title>Finding injection attacks by looking for injection attacks is a fail</title>
		<link>http://www.networkforensics.com/2011/06/21/finding-injection-attacks-by-looking-for-injection-attacks-is-a-fail/</link>
		<comments>http://www.networkforensics.com/2011/06/21/finding-injection-attacks-by-looking-for-injection-attacks-is-a-fail/#comments</comments>
		<pubDate>Tue, 21 Jun 2011 01:53:00 +0000</pubDate>
		<dc:creator>Gary Golomb</dc:creator>
				<category><![CDATA[code]]></category>
		<category><![CDATA[forensics]]></category>
		<category><![CDATA[injection]]></category>
		<category><![CDATA[Network Forensics]]></category>
		<category><![CDATA[Network Visbility]]></category>
		<category><![CDATA[Obfuscated traffic]]></category>

		<guid isPermaLink="false">http://www.networkforensics.com/?p=820</guid>
		<description><![CDATA[I tend to be an opponent of looking for bad stuff by using &#8220;known bad dictionaries&#8221; like IP lists, signatures, etc. I tend to soapbox about how you can find far more known and unknown bad stuff by employing a methodology of separating out &#8220;presumed good&#8221; stuff, and examining outliers. Check out any of the [...]]]></description>
		<wfw:commentRss>http://www.networkforensics.com/2011/06/21/finding-injection-attacks-by-looking-for-injection-attacks-is-a-fail/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Using WinDbg to Begin Reverse Engineering Unknown Malware from Memory</title>
		<link>http://www.networkforensics.com/2011/06/13/using-windbg-to-begin-reverse-engineering-unknown-malware-from-memory/</link>
		<comments>http://www.networkforensics.com/2011/06/13/using-windbg-to-begin-reverse-engineering-unknown-malware-from-memory/#comments</comments>
		<pubDate>Mon, 13 Jun 2011 03:03:46 +0000</pubDate>
		<dc:creator>Gary Golomb</dc:creator>
				<category><![CDATA[Advanced Threats]]></category>
		<category><![CDATA[code]]></category>
		<category><![CDATA[forensics]]></category>
		<category><![CDATA[malware]]></category>
		<category><![CDATA[Malware Analysis]]></category>
		<category><![CDATA[Network Forensics]]></category>
		<category><![CDATA[network forensics]]></category>
		<category><![CDATA[PE EXE files]]></category>
		<category><![CDATA[Reverse Engineering]]></category>
		<category><![CDATA[trojan]]></category>

		<guid isPermaLink="false">http://www.networkforensics.com/?p=788</guid>
		<description><![CDATA[Part Two in a multi-part series on holistic, multi-disciplinary analysis and reversing. &#160; The last post, &#8220;Mutex Analysis: The Canary in the Coal Mine,&#8221; started off showing to use mutexes to discover malware that is difficult to locate using more traditional methods and tools. We used a live compromised system for the example and the [...]]]></description>
		<wfw:commentRss>http://www.networkforensics.com/2011/06/13/using-windbg-to-begin-reverse-engineering-unknown-malware-from-memory/feed/</wfw:commentRss>
		<slash:comments>4</slash:comments>
		</item>
		<item>
		<title>Mutex Analysis: The Canary in the Coal Mine (and Discovering New Families of Malware?)</title>
		<link>http://www.networkforensics.com/2011/06/11/mutex-analysis-the-canary-in-the-coal-mine-and-discovering-new-families-of-malware/</link>
		<comments>http://www.networkforensics.com/2011/06/11/mutex-analysis-the-canary-in-the-coal-mine-and-discovering-new-families-of-malware/#comments</comments>
		<pubDate>Sat, 11 Jun 2011 10:34:40 +0000</pubDate>
		<dc:creator>Gary Golomb</dc:creator>
				<category><![CDATA[Advanced Threats]]></category>
		<category><![CDATA[code]]></category>
		<category><![CDATA[forensics]]></category>
		<category><![CDATA[hacked]]></category>
		<category><![CDATA[malware]]></category>
		<category><![CDATA[Malware Analysis]]></category>
		<category><![CDATA[Network Forensics]]></category>
		<category><![CDATA[network forensics]]></category>
		<category><![CDATA[Reverse Engineering]]></category>
		<category><![CDATA[trojan]]></category>

		<guid isPermaLink="false">http://www.networkforensics.com/?p=755</guid>
		<description><![CDATA[Part One in a multi-part series on holistic, multi-disciplinary analysis and reversing. This post is based on a presentation I gave at the last Thotcon, but was really prompted by a case from a couple days ago. It&#8217;s an interesting example of how the same disciplined methodologies for finding malicious traffic on the network also [...]]]></description>
		<wfw:commentRss>http://www.networkforensics.com/2011/06/11/mutex-analysis-the-canary-in-the-coal-mine-and-discovering-new-families-of-malware/feed/</wfw:commentRss>
		<slash:comments>2</slash:comments>
		</item>
		<item>
		<title>Network Forensics and Reverse Engineering Part 2 – A deeper dive into real JavaScript analysis and reverse engineering</title>
		<link>http://www.networkforensics.com/2011/01/12/network-forensics-and-reverse-engineering-part-2-%e2%80%93-a-deeper-dive-into-real-javascript-analysis-and-reverse-engineering/</link>
		<comments>http://www.networkforensics.com/2011/01/12/network-forensics-and-reverse-engineering-part-2-%e2%80%93-a-deeper-dive-into-real-javascript-analysis-and-reverse-engineering/#comments</comments>
		<pubDate>Wed, 12 Jan 2011 03:36:14 +0000</pubDate>
		<dc:creator>Gary Golomb</dc:creator>
				<category><![CDATA[Advanced Threats]]></category>
		<category><![CDATA[code]]></category>
		<category><![CDATA[Decompile]]></category>
		<category><![CDATA[forensics]]></category>
		<category><![CDATA[JavaScript]]></category>
		<category><![CDATA[malware]]></category>
		<category><![CDATA[Malware Analysis]]></category>
		<category><![CDATA[Network Forensics]]></category>
		<category><![CDATA[network forensics]]></category>
		<category><![CDATA[Reverse Engineering]]></category>

		<guid isPermaLink="false">http://www.networkforensics.com/?p=699</guid>
		<description><![CDATA[Introduction In our first post in the forensics and reversing series, we examined why HTTP gzip content encoding is a larger and more serious problem than most people realize. We’ll use the end of the first post as a starting point for analysis in this post. It also serves as an example of something far [...]]]></description>
		<wfw:commentRss>http://www.networkforensics.com/2011/01/12/network-forensics-and-reverse-engineering-part-2-%e2%80%93-a-deeper-dive-into-real-javascript-analysis-and-reverse-engineering/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>Network Forensics and Reversing Part 1 &#8211; gzip web content, java malware, and a little JavaScript</title>
		<link>http://www.networkforensics.com/2010/11/14/network-forensics-and-reversing-part-1-gzip-web-content-java-malware-and-a-little-javascript/</link>
		<comments>http://www.networkforensics.com/2010/11/14/network-forensics-and-reversing-part-1-gzip-web-content-java-malware-and-a-little-javascript/#comments</comments>
		<pubDate>Sun, 14 Nov 2010 16:52:32 +0000</pubDate>
		<dc:creator>Gary Golomb</dc:creator>
				<category><![CDATA[Breach]]></category>
		<category><![CDATA[Decompile]]></category>
		<category><![CDATA[Java malware]]></category>
		<category><![CDATA[JavaScript]]></category>
		<category><![CDATA[Malware Analysis]]></category>
		<category><![CDATA[NetWitness Rules]]></category>
		<category><![CDATA[Network Forensics]]></category>
		<category><![CDATA[network forensics]]></category>
		<category><![CDATA[Network Visbility]]></category>
		<category><![CDATA[Obfuscated traffic]]></category>
		<category><![CDATA[Reverse Engineering]]></category>
		<category><![CDATA[trojan]]></category>

		<guid isPermaLink="false">http://www.networkforensics.com/?p=526</guid>
		<description><![CDATA[Something I’ve found unsettling for some time now is the drastically increased usage of gzip as a Content-Encoding transfer type from web servers. By default now, Yahoo, Google, Facebook, Twitter, Wikipedia, and many other organizations compress the content they send to your users. From that list alone, you can infer that most of the HTTP [...]]]></description>
		<wfw:commentRss>http://www.networkforensics.com/2010/11/14/network-forensics-and-reversing-part-1-gzip-web-content-java-malware-and-a-little-javascript/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Sometimes the answer really is that simple&#8230;</title>
		<link>http://www.networkforensics.com/2010/10/26/sometimes-the-answer-really-is-that-simple/</link>
		<comments>http://www.networkforensics.com/2010/10/26/sometimes-the-answer-really-is-that-simple/#comments</comments>
		<pubDate>Tue, 26 Oct 2010 18:38:39 +0000</pubDate>
		<dc:creator>tim</dc:creator>
				<category><![CDATA[Advanced Threats]]></category>
		<category><![CDATA[Malware Analysis]]></category>
		<category><![CDATA[Network Forensics]]></category>

		<guid isPermaLink="false">http://www.networkforensics.com/?p=442</guid>
		<description><![CDATA[Early this year, we were challenged by our CEO Amit Yoran to take this perpetual battle against Malware to the next level.  Easily, one of the most common use cases today of NetWitness Nextgen, is the combating of various forms of commercial and custom malicious code.  The goal of helping our customers optimize their efforts [...]]]></description>
		<wfw:commentRss>http://www.networkforensics.com/2010/10/26/sometimes-the-answer-really-is-that-simple/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>It&#8217;s Malware!</title>
		<link>http://www.networkforensics.com/2010/10/18/its-malware/</link>
		<comments>http://www.networkforensics.com/2010/10/18/its-malware/#comments</comments>
		<pubDate>Mon, 18 Oct 2010 12:33:46 +0000</pubDate>
		<dc:creator>Gary Golomb</dc:creator>
				<category><![CDATA[Breach]]></category>
		<category><![CDATA[Competitor Hype]]></category>
		<category><![CDATA[cybercrime]]></category>
		<category><![CDATA[Malware Analysis]]></category>
		<category><![CDATA[Network Forensics]]></category>
		<category><![CDATA[network forensics]]></category>
		<category><![CDATA[Network Visbility]]></category>
		<category><![CDATA[trojan]]></category>
		<category><![CDATA[zeus]]></category>

		<guid isPermaLink="false">http://www.networkforensics.com/?p=461</guid>
		<description><![CDATA[Zeus is evolving. In regards to a new release, one Anti-Virus vendor recently noted: “[the new exe] uses techniques designed to avoid automatic heuristics-based detection.” The discussion then proceeds to examine how the exe is different from previous versions of the malware. Should we be alarmed that Zeus is getting so sophisticated that it evades [...]]]></description>
		<wfw:commentRss>http://www.networkforensics.com/2010/10/18/its-malware/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Tracking the &#8220;Here You Have&#8221; Worm</title>
		<link>http://www.networkforensics.com/2010/09/10/tracking-the-here-you-have-worm/</link>
		<comments>http://www.networkforensics.com/2010/09/10/tracking-the-here-you-have-worm/#comments</comments>
		<pubDate>Fri, 10 Sep 2010 15:59:59 +0000</pubDate>
		<dc:creator>alex</dc:creator>
				<category><![CDATA[Malware Analysis]]></category>
		<category><![CDATA[Network Forensics]]></category>
		<category><![CDATA[Network Visbility]]></category>
		<category><![CDATA[Situational Awareness]]></category>
		<category><![CDATA[Uncategorized]]></category>

		<guid isPermaLink="false">http://www.networkforensics.com/?p=420</guid>
		<description><![CDATA[If you&#8217;ve kept a view on security news in the past 24 hours, you may have noticed some press around a new email worm spreading on corporate networks.   Dubbed the &#8220;Here You Have&#8221; worm, it is a good case study on how to manage emerging threats with your NetWitness technology.  You can find additional [...]]]></description>
		<wfw:commentRss>http://www.networkforensics.com/2010/09/10/tracking-the-here-you-have-worm/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Mini Decoder in Action @TaoSecurity</title>
		<link>http://www.networkforensics.com/2010/09/10/mini-decoder-in-action-taosecurity/</link>
		<comments>http://www.networkforensics.com/2010/09/10/mini-decoder-in-action-taosecurity/#comments</comments>
		<pubDate>Fri, 10 Sep 2010 14:49:45 +0000</pubDate>
		<dc:creator>brian</dc:creator>
				<category><![CDATA[Network Forensics]]></category>

		<guid isPermaLink="false">http://www.networkforensics.com/?p=414</guid>
		<description><![CDATA[Thanks Richard at TaoSecurity for the post on our mini device.]]></description>
		<wfw:commentRss>http://www.networkforensics.com/2010/09/10/mini-decoder-in-action-taosecurity/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Leveraging Custom Actions in NetWitness Investigator</title>
		<link>http://www.networkforensics.com/2010/08/30/leveraging-custom-actions-in-netwitness-investigator/</link>
		<comments>http://www.networkforensics.com/2010/08/30/leveraging-custom-actions-in-netwitness-investigator/#comments</comments>
		<pubDate>Mon, 30 Aug 2010 17:19:33 +0000</pubDate>
		<dc:creator>alex</dc:creator>
				<category><![CDATA[Malware Analysis]]></category>
		<category><![CDATA[Network Forensics]]></category>
		<category><![CDATA[Network Visbility]]></category>
		<category><![CDATA[pentesting]]></category>
		<category><![CDATA[Situational Awareness]]></category>

		<guid isPermaLink="false">http://www.networkforensics.com/?p=393</guid>
		<description><![CDATA[One of the lesser-known features that was recently introduced in NetWitness Investigator are Custom Actions.   Have you ever been analyzing a pcap in Investigator and thought &#8220;I wish there was an easy way to push this information into another system&#8230;&#8221;.   Custom Actions is a flexible extension system that will allow you to do [...]]]></description>
		<wfw:commentRss>http://www.networkforensics.com/2010/08/30/leveraging-custom-actions-in-netwitness-investigator/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
	</channel>
</rss>

