Track 3 Saturday·46 min
Rami Al-Talhi
Shows how Wireshark plus JA3, JARM and SSH fingerprints can expose APT activity hidden in encrypted packet captures.
networkincident-responsethreat-detection+1
DEF CON 34 talks are here: 354 talks, summarized and searchable.
Browse DEF CON 341 talk in the archive.
1–1 of 1 talk
Track 3 Saturday·46 min
Rami Al-Talhi
Shows how Wireshark plus JA3, JARM and SSH fingerprints can expose APT activity hidden in encrypted packet captures.