#bothunter

As the bots continue to spread in our tag, we have hired another promising BotHunter.

Please welcome Michael.

He's more the silent type.

He likes pumpkins. 🎃

We are currently residing on an abandoned oil rig in the North Sea. Or in a sleeping volcano on an island in the Pacific. Or in a secret high-tech fortress hidden in the ice of Antarctica. Or anywhere else.

For centuries we were working from the shadows to asexualise the world.

The bot invasion of the asexual tag has forced us to take direct action.

We hunt bots. We slay bots. We kill bots. We shoot, stab, crush and massacre bots.

And we do like to blow them up.

Anyway, you may contact us and ask anything you like. Although you might not like the answers (insert sinister laugh here).

More file extraction testing. Here we're looking at the highest ranked bothunter event for the last week, which is classified as "/snort-trojan-activity/Egg Download/: 1.7002773:E3-Egg Download ET TROJAN FSG Packed Binary via HTTP Inbound". The reputation result from SRI is expected, and the direct integration to virustotal is working well. 

The staff here at MetaFlows has been given charge of setting up a google group for BotHunter users. This group is for helping people make the best of BotHunter. We use it in lots of deployments around the world and could not exist without it. We have a lot to contribute to the community of BotHunter users and hope you will share your ideas.

The Malware Lifecycle

BotHunter is capable of declaring a host infected when either of three dialog sequence combinations are observed:

Condition 1: Evidence of a local host infection, and evidence of outward malware coordination or attack propagation, or  Condition 2: At least two distinct signs of outward bot coordination, attack propagation, or attacker preparation sequences are observed. Condition 3:  Evidence that a local host has attempted to establish communication with a confirmed malware control host or drop site.

Learn more about BotHunter:

BotHunter.net

Event categories for classifying the stages and types of malware communications. You can learn more at the BotHunter website http://www.bothunter.net/releasenotes.html