7 days ago7 min read
top of page
2 days ago2 min read
3 days ago3 min read
Jun 272 min read
Jun 214 min read
Jun 94 min read
Jun 58 min read
What I Found In A Zeek Dataset (And How I Found It)
Started with a raw Zeek log — no SIEM, no alerts. Uncovered a Mirai botnet within hours. Found primary attacker via ICMP pings and 500K+ failed Telnet/SSH scans Traced spread across four subnets Confirmed second infected host and AWS C2 server Result: Complete threat profile from raw data alone.
bottom of page