Wireshark Tutorial: Display Filter Expressions
Summary: A Unit 42 Palo Alto Networks tutorial, updated for 2023, walks through Wireshark display filter expressions for reviewing pcaps of malware-generated traffic from infected Windows hosts, using five sample pcaps in a password-protected ZIP on GitHub. It builds saved filter buttons such as "basic," "basic+" and "basic+dns," then applies them to traffic including Loki Bot HTTP POSTs to 194.55.224[.]9, IcedID domains, Ave Maria RAT activity to adaisreal.ddns[.]net on TCP port 7888, and FTP exfiltration to valvulasthermovalve[.]cl.
Bottom line: The tutorial's own example shows a compromised FTP site's username and password followed by a STOR command sending an HTML file off the infected host - the kind of exfiltration that only surfaces if an analyst knows which filter to run.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Endpoint & Network Security
- Related
- Adapting to AI penetration testing orchestrators: The Modern Security Model Cyber Risks · Nov 13, 2026Introducing Spend Management: Spending limits and alerts for Cloudflare Cyber Risks · Nov 13, 2026Choosing Que Paxa, an unusual consensus algorithm Cyber Risks · Nov 11, 2026