What changed in the analysis engine and the reports: new detection rules, new network checks and new report sections.
Every report prints the engine and ruleset versions it was made with, so a finding can be traced to the rules of its day.
Infostealer payloads and mail exfiltration
Mail a host sends to an SMTP server on the internet (port 25, 465, 587 or 2525) within five minutes of asking a lookup service for its public IP address is reported as exfiltration (MITRE ATT&CK T1048): High within two minutes, even when STARTTLS hides the message. Payloads disguised as text are reported as downloads (T1105): a base64-encoded Windows executable and, for clients that are not browsers, a body of 64 KiB or more that is one run of base64 or a script built from string chunks.
A TLS connection to a domain written with look-alike letters from another alphabet, such as a Cyrillic а in amazon.com, is decoded from punycode and reported as a phishing finding (MITRE ATT&CK T1566.002): High when it reads as a popular domain, Medium for mixed scripts in one label.
A second, different TLS client on a host that downloads 64 KiB or more from a name a browser has just opened is reported as a payload download (T1105). A tool that looks up the public IP address over cleartext HTTP is reported as discovery (T1614 when the answer carries a location, otherwise T1016). Reports also list the DNS names in the certificates of the servers a finding names.
When nothing is found, the summary and the report now say what this capture let the engine check, for example how many checks ran across how many areas, instead of a bare "no threats". A capture with too little traffic to check is marked as not assessed rather than low risk.
TLS versions and weak certificates
Security reports flag certificates with MD2, MD5 or SHA-1 signatures, RSA or DSA keys below 2048 bits, EC keys below 224 bits, and expired certificates, and say which TLS versions the capture showed.
Read-only check commands in fix steps
Troubleshooting fix steps describe the change in words and print the read-only commands that confirm the problem and the fix, such as ping, traceroute or dig, to run from a host you control. Captures cut short by a snapshot length are measured at their length on the wire.
New report engine for Troubleshooting and Security
Both report types share one structure: a one-page executive summary; scope, evidence integrity and limitations; every problem or finding with its evidence; a remediation roadmap with owners and verification; coverage of what was checked; assets and capture quality. The sample reports were regenerated with it.
We use PostHog analytics cookies to see which pages lead to an upload or a purchase. If you decline, we
count your visit without cookies.
Privacy Policy
