Webcasts

Could DNS traffic be hiding active C2 in your environment right now?

Join us for a free monthly one-hour training session on command & controls and malicious traffic with Faan Rossouw (Active Countermeasures) and learn a stealthy C2 technique that bypasses common DNS tunneling detections and how to catch it.

What you’ll learn:
- How attackers abuse DNS TXT records to deliver payloads (server to agent)
- Why low-subdomain-count DNS C2 slips past default thresholds
- The behavioral signals defenders can reliably hunt for
- A real-world case study: Joker Screenmate malware (DomainTools, July 2025)

Faan will walk through a full threat hunt, so you'll leave with practical skills you can apply immediately, including one Zeek command you can run today to find TXT record abuse in your logs.

See more Command & Control webcasts at https://www.youtube.com/activecountermeasures

Chat with your fellow attendees in the BHIS Discord server:
https://discord.gg/bhis
in the #🔴live-chat channel

42 0

We welcome you to join us for our monthly webcast series where we will have open and casual discussions about command and control, malwares, and expand upon our Malware of the Day blog posts.

This is an interactive webcast to include comments and questions from attendees so you can be part of this too! Join the Threat Hunter Community Discord to interact during the webcast in the #live-webcast-chat channel here: https://discord.gg/threathunter

In Episode 6 we examine how threat actors can misuse the legitimate remote DFIR tool, Velociraptor, to establish C2 capabilities.

P.S. You are also welcome to join us up to 30 minutes early for pre-show banter!

20 0

We welcome you to join us for our monthly webcast series where we will have open and casual discussions about command and control, malwares, and expand upon our Malware of the Day blog posts.

This is an interactive webcast to include comments and questions from attendees so you can be part of this too! Join the Threat Hunter Community Discord to interact during the webcast in the #live-webcast-chat channel here: https://discord.gg/threathunter

In Episode 5 we focus on how threat actors use tunneling tools (Ligolo-ng) to pivot their C2 communication across an internal network.

P.S. You are also welcome to join us up to 30 minutes early for pre-show banter!

14 2

🔗 Register HERE for FREE Infosec Webcasts, Anti-casts & Summits – Including this one!
https://poweredbybhis.com

Our monthly webcast series where we will have open and casual discussions about command and control, malwares, and expand upon our Malware of the Day blog posts.

Join us for this Episode 4 webcast, where we'll show you how to set up your own Threat Hunting lab at home. You'll learn how to create a vulnerable host and run a simulated compromise using Sliver C2. We'll then set up and configure Zeek and Sysmon for monitoring, and use RITA for behavioral network analysis. This webcast will empower you to run your own network compromises and threat hunts at home, allowing you to develop hands-on skills and gain practical experience.

This is an interactive webcast to include input, comments and questions from attendees so you can be part of this too! You are welcome to join the Threat Hunter Discord to be part of the webcast in the #live-webcast-chat channel here: https://discord.gg/threathunter

P.S. You are also welcome to join us up to 30 minutes early for pre-show banter!

42 2

Our monthly webcast series where we will have open and casual discussions about command and control, malwares, and expand upon our Malware of the Day blog posts.

This is an interactive webcast to include input, comments and questions from attendees so you can be part of this too! You are welcome to join the Threat Hunter Discord to be part of the webcast in the #live-webcast-chat channel here: https://discord.gg/threathunter

In this Episode 3, we will explore DNS Tunneling and the dnscat2 DNS tunnel.


P.S. You are also welcome to join us up to 30 minutes early for pre-show banter!

18 0

Our monthly webcast series where we will have open and casual discussions about command and control, malwares, and expand upon our Malware of the Day blog posts.

This is an interactive webcast to include input, comments and questions from attendees so you can be part of this too! You are welcome to join the Threat Hunter Discord to be part of the webcast in the #live-webcast-chat channel here: https://discord.gg/threathunter

In this Episode 2, we will discuss the Merlin command and control framework and data jitter.

14 0

We welcome you to join us for our new monthly webcast series where we will have open and casual discussions about command and control, malwares, and expand upon our Malware of the Day blog posts.

This is an interactive webcast to include comments and questions from attendees so you can be part of this too! Join the Threat Hunter Community Discord to interact during the webcast in the #live-webcast-chat channel here: https://discord.gg/threathunter

In this Episode 1, we will discuss the Fiesta malware command and control and we hope to see you there!

26 1

We all have gaps in our security knowledge. Fireside Fridays will be an opportunity to fill in those gaps. Each Friday we will pick a topic and go over the basics. These sessions will be a combination of lecture and hands on labs. We’ll cover a single topic and hopefully fill in some of those cracks. Think of it as a single focused “ask us anything” session. No judgment on the questions that get asked, just a chance to raise the bar for all of us.

In this episode of Fireside Fridays we will discuss authentication and password policies. We’ll also look at how passwords are “cracked” discussing online and offline password cracking.

Chat with your fellow attendees in the Threat Hunter Community Discord server: https://discord.gg/threathunter in the #🔥live-chat channel.

13 1

In the final installment of our VPN discussions, we will leverage the previous defined framework to understand various VPN technologies. We will discuss SSH, IPSec as well as TLS. We will also review recommended configuration options for each implementation.

Chat with your fellow attendees in the Threat Hunter Community Discord server: https://discord.gg/threathunter in the #🔥live-chat channel.

7 5