@mfmokbel

Detect Shulfar Malware Encrypted TCP C&C Traffic Using PacketSmith Yara-X Detection Module

3d ago · 7 min read · Introduction Splunk published a blog post about a variant of the Gh0stRat malware family used in a new campaign delivered alongside the CloverPlus adware. The blog post is titled "Not Just Annoying Ad

Detect SnappyClient C&C Traffic Using PacketSmith + Yara-X Detection Module

Mar 23 · 6 min read · Introduction Zscaler published a blog post about a new malware called SnappyClient, written in the C++ programming language. The malware communicates with its C&C server using a custom binary protocol

Detect Malicious .ip6.arpa TLD Reverse DNS Zone Response Packets using PacketSmith Yara-X Detection Module

Mar 17 · 4 min read · Introduction The other day, I was reading this interesting article Abusing .arpa: The TLD That Isn’t Supposed to Host Anything by Infoblox threat intel team, published on February 26, 2026. What got m

How to Apply VXLAN-GBP Encapsulation to PCAP Files Using PacketSmith

Mar 16 · 3 min read · Introduction In version 5.1.0 (codenamed Taxus), released on March 16, 2026, the injection engine has undergone a significant evolution, transitioning from basic command-line parameters to a robust, t

How to Detect EternalBlue Exploitation

Feb 12 · 3 min read · Introduction On February 05, 2026, we released version 5 of PacketSmith, featuring a new detection module that seamlessly integrates Yara-X with most of the protocols supported by PacketSmith. To demo