Learning Outline

• 1. PCAP File Scanning — Extracting payloads with tshark, scanning with YARA
• 2. HTTP Payload Analysis — Detecting malicious URLs, user-agents, responses
• 3. DNS Traffic — Detecting DNS tunneling, suspicious domain patterns
• 4. SMTP/Mail Scanning — Phishing emails, malicious attachments
• 5. TLS/SSL Inspection — Certificate patterns, JA3 fingerprints
• 6. Live Traffic Tools — Zeek (Bro), Suricata with YARA integration
• 7. Extracted Files — Scanning network-extracted PE files, scripts, documents

🔗 Resources

• 📦 yara-pcap - Scan PCAP files directly
• 🔌 Suricata (YARA integration)
• 📊 Zeek Network Security Monitor
• 🌐 YARA HTTP Analyzer