The User Agent Field: Analyzing and Detecting the Abnormal or Malicious in your Organization

Hackers are hiding within the noise of HTTP traffic. They understand that within this noise it is becoming increasingly difficult to detect malicious traffic. They know that overworked analysts have little time to detect malicious/abnormal HTTP traffic hiding amongst a mountain of legitimate HTTP...

By

Darren Manners

February 7, 2012

All papers are copyrighted. No re-posting of papers is permitted

Related Content

DFIR - Blog - HUMINT and its Role within Cybersecurity_340 x 340.jpg

Digital Forensics, Incident Response & Threat Hunting

October 4, 2024

HUMINT and its Role within Cybersecurity

This blog explores HUMINT's role in cybersecurity, detailing its implementation, benefits, and potential risks.

370x370 Jon DiMaggio.png

Digital Forensics, Incident Response & Threat Hunting

January 16, 2024

FOR528: Ransomware & Cyber Extortion Course Updates Implemented – What’s New?

The recent FOR528 course better addresses the differences between ransomware and cyber extortion, and provides new hands-on labs and bonus content.

Blog_teaser_images_(19).png

Digital Forensics, Incident Response & Threat Hunting, Open-Source Intelligence (OSINT)

August 31, 2023

FOR589: Cybercrime Intelligence - NEW SANS DFIR Course coming soon

Learn to traverse the cyber underground, social engineer cybercriminals and investigate illicit cryptocurrency activity.

Sean O'Connor