Archive | Oktober, 2015
Endpoint Attacker Detection

Synergetic Effects of Network and Host Based APT Detection

People often ask me if they still need our host based scanner THOR now that they have bought a network appliance that already checks all content that goes into and leaves their network. I normally answer that it is not a question of one solution versus another, but a combination of solutions to achieve the […]

2 Comments Continue Reading →
Yara Signatures

How to Write Simple but Sound Yara Rules – Part 2

Months ago I wrote a blog article on „How to write simple but sound Yara rules„. Since then the mentioned techniques and tools have improved. I’d like to give you a brief update on certain Yara features that I frequently use and tools that I use to generate and test my rules. (mehr …)

6 Comments Continue Reading →