Hunting Anomalous Connections and Infrastructure With TLS Certificates

According to Sophos, 46% of all malware now uses Transport Layer Security (TLS) to conceal its communication channels. A number that has doubled in the last year alone. Malware, such as LockBit ransomware, AgentTesla and Bladabini remote access tools (RATs), has been observed using TLS for powerShell based droppers, for accessing pastebin to retrieve code... The post Hunting Anomalous Connections and Infrastructure With TLS Certificates appeared first on Databricks....

Submit