Precursor: A Quantum Leap in Arbitrary Payload Similarity Analysis
Summary: GreyNoise Labs researcher Matt Lehman introduced a tool called Precursor that labels and finds similarities in text, hex, or base64 encoded data using arbitrary similarity algorithms such as MRSHv2 and SSDEEP. The tool offers a binary input mode for firmware and malware analysis, a generic similarity vector output for machine learning ingestion, and a training mode that configures the optimal algorithm and distance thresholds, and GreyNoise used it to analyze a cyberattack targeting Israel.
What's compelling: GreyNoise has already applied Precursor to a real attack against Israel, so the same similarity matching it uses for attribution and C2 detection is now pointed at traffic patterns your own network generates.
Read the original at GreyNoise Blog ↗
- Topics
- Detection & Response
- Related
- YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026Inside Falcon AI Gateway: One Control Point for AI Traffic Cyber Risks · Nov 13, 2026Macfinger Click Fix campaign sends Down TheDRAIN infostealer for macOS, (Fri, Nov 13th) Cyber Risks · Nov 13, 2026