Coruna iOS Exploit Kit PCAP Analysis Without Decryption
An iPad on iPadOS 15.8.2 opens a lure page: a second TLS client pulls 685 kB, then the device is geolocated. Reading a Coruna-like drive-by from the PCAP.
PCAP Analysis Blog
Guides and case studies on reading packet captures: shrinking large PCAPs, Wireshark vs automated analysis, malware traffic walkthroughs and network forensics.
SHub Stealer PCAP Analysis: Finding C2 in Encrypted Traffic
A SHub Stealer infection read without decrypting a byte: fake-software lure, .cfd C2 behind Cloudflare, a 2.2 MB loot upload, a 61-second beacon.
Atomic macOS Stealer (AMOS): Reading the C2 Protocol from a PCAP
A real AMOS (Atomic macOS Stealer) infection read straight off the wire: the curl boot beacon, eight plaintext collection stages, a 3.4 MB loot upload, and the C2 tasking loop — all to one DigitalOcean VPS over plain HTTP.
How to Reduce a PCAP File for Analysis (editcap & tshark)
Got a capture too big to upload or open? Trim it to the packets that matter with editcap and tshark — strip payloads or isolate one conversation — without losing the TCP signal that explains a slow transfer.
AgentTesla FTP Exfiltration: A PCAP Walkthrough
We run a real GuLoader-to-AgentTesla capture through PcapAI: cleartext FTP credentials (T1040) and FTP data exfiltration (T1048.003), traced packet by packet.
macOS ClickFix Stealer: A PCAP Walkthrough
A fake Claude installer used ClickFix to drop a macOS stealer. We trace its curl HTTP C2 beacon and 11 MB of plaintext exfiltration packet by packet.
PcapAI vs Wireshark: AI-Powered Analysis vs Manual Inspection
Compare PcapAI and Wireshark for PCAP analysis. AI-generated MITRE-mapped PDF reports in under 5 minutes vs hours of manual packet inspection.
10 Essential Insights Every PCAP Analysis Report Needs
Learn the 10 critical insights every PCAP analysis report must include. From risk scores to remediation roadmaps, discover what separates pro reports.
MCP Server Integration: AI-Powered Network Forensics
Let AI agents like Claude run deep packet inspection and network forensics on your PCAPs. The PcapAI MCP Server uploads each capture for server-side analysis.
Why Automated PCAP Reporting Is No Longer Optional
Automated PCAP reporting cuts analysis time from 5 hours to 4 minutes. Why SOC teams are replacing manual Wireshark workflows with AI-driven analysis.
PCAP Analysis Guides
Step-by-step tutorials on detecting malware, C2 beaconing, credential exposure, and protocol anomalies in packet captures.
Threat Intelligence
Real-world case studies mapping observed network traffic to MITRE ATT&CK techniques, with the ISO 27001, NIST SP 800-53, CIS and PCI DSS controls to review.
MCP & API Integration
Guides on running PCAP analysis from Claude Desktop through the MCP server, and from scripts and CI pipelines through the REST API.