Generated by All in One SEO v5.0.0.1, this is an llms.txt file, used by LLMs to index the site.

# DrKeithJones.com

A cybersecurity researcher's journey.

## Sitemaps

- [XML Sitemap](https://drkeithjones.com/sitemap.xml): Contains all public & indexable URLs for this website.

## Posts

- [Detecting Amadey Malware With Zeek - Zeek Roulette #2](https://drkeithjones.com/index.php/2023/06/15/detecting-amadey-malware-with-zeek-zeek-roulette-2/) - For my Zeek Roulette #2 I picked a recently submitted sample off of ANY.Run that ended up being Amadey: https://app.any.run/tasks/31ba58da-30d1-4a08-940d-2412fc629221/ You can download the PCAP from the link above if you navigate to the "PCAP" button in the upper right corner of the lower network connections pane. If you want to just get to the
- [Polish "Powiadomienie" JS Campaign — Credential Theft via FTP Exfiltration](https://drkeithjones.com/index.php/2026/07/30/polish-powiadomienie-js-campaign-credential-theft-via-ftp-exfiltration/) - A 3.6 MB JavaScript file, hardened with `javascript-obfuscator` — rotated string arrays, index decoders, 53 dead dispatcher functions, a catastrophic backtracking regex trap — ends with a plaintext FTP upload of your saved browser passwords. The entire malicious activity: 3 seconds. Join me as I walk through the malware sample and PCAP — breaking down
- [The 1.7 MB CAPTCHA — How a Fake Human Verification Check Delivered Two RATs](https://drkeithjones.com/index.php/2026/06/26/the-1-7-mb-captcha-how-a-fake-human-verification-check-delivered-two-rats/) - A fake CAPTCHA — 1.7 MB of React 19 served from a .top domain — tricks a visitor into pressing Win+Rand pasting PowerShell. No browser sandbox escape needed. No exploit. Just social engineering. What follows is a 6-stage infection chain: A 3-hop JavaScript DOM injection chain (no HTTP redirects, no network-level visibility) A fake CAPTCHA
- [Hunting Lazy OPSEC: Spotting Default C2 Certificates with DuckDB and Zeek](https://drkeithjones.com/index.php/2026/04/22/hunting-lazy-opsec-spotting-default-c2-certificates-with-duckdb-and-zeek/) - Threat actors love to reuse tools, and sometimes, they get lazy. Case in point: AsyncRAT and its notorious fork, DcRAT. These remote access trojans often ship with default, self-signed certificates. If the operators don't bother to swap them out before deploying their infrastructure, they leave a massive, highly visible behavioral red flag in the network
- [Beyond the Grep: Hunting Malware with Zeek and DuckDB SQL](https://drkeithjones.com/index.php/2026/04/14/beyond-the-grep-hunting-malware-with-zeek-and-duckdb-sql/) - Hunting through raw Zeek logs just got a massive upgrade. If you’ve spent years in the SOC, you’ve likely built up a library of complex awk chains and grep commands to parse Zeek data. It works, but it’s brittle and hard to read. I recently used DuckDB and the zeek-duckdb extension to analyze a malware
- [How I Used Gemini To Fix My Terrible Zeek Documentation](https://drkeithjones.com/index.php/2025/11/24/how-i-used-gemini-to-fix-my-terrible-zeek-documentation/) - I built a Zeek-based Amadey malware detector… and then absolutely did NOT document it. https://github.com/keithjjones/zeek-amadey-detector So instead of fixing my own mess, I made Gemini do it. In this video: How to upload your Zeek package into Gemini The prompt I use How Canvas mode helps write a good README How to refine tone (dark
- [Fix NoMachine's CAPS LOCK Reversal Bug](https://drkeithjones.com/index.php/2025/02/16/fix-nomachines-caps-lock-reversal-bug/) - Learn how to quickly fix your caps lock when it is reversed on your remote NoMachine host when compared to your local computer!
- [Keith Jones' Journey As Expert Digital Forensics Expert To AI Malware Researcher](https://drkeithjones.com/index.php/2025/02/03/keith-jones-journey-as-expert-digital-forensics-expert-to-ai-malware-researcher/) - Had a great time as a guest on the Security Unfiltered Podcast, talking about work-life balance in cybersecurity—especially for parents. We covered how remote work has shifted expectations, the challenge of growing your career while raising a family, and how AI is changing the industry.One thing that stood out: flexibility isn’t just a perk anymore.
- [Manually Download MacOS Sequoia](https://drkeithjones.com/index.php/2025/01/30/manually-download-macos-sequoia/) - Apple’s macOS updates are typically seamless through the App Store, but sometimes, a bug can throw a wrench in the process. I found a workaround: manually downloading the installer and writing it to a USB stick. If you’ve ever been stuck in a similar situation, here’s how you can do it, too.
- [Drone Flight @ BWI Airport Sept 8, 2024](https://drkeithjones.com/index.php/2024/09/11/drone-flight-bwi-airport-sept-8-2024/) - Enjoy some runway 33L activity at the Baltimore Washington International Airport in Maryland.
- [Detect STRRAT Malware With Zeek And Suricata](https://drkeithjones.com/index.php/2024/08/31/detect-strrat-malware-with-zeek-and-suricata/) - Join me in learning how to detect the STRRAT malware family with Zeek and Suricata.
- [Detect Gozi Banking Malware With Zeek!](https://drkeithjones.com/index.php/2024/05/01/detect-gozi-banking-malware-with-zeek/) - Join the Old Grizzled FBI Agent to hear how to detect the Gozi Banking Malware Family with Zeek!
- [Detecting AsyncRAT Malware C2 With Zeek And Suricata](https://drkeithjones.com/index.php/2024/04/26/detecting-asyncrat-malware-c2-with-zeek-and-suricata/) - Please join the "Old Grizzled FBI Agent" to hear how you can detect the AsyncRAT malware family with Suricata and Zeek!
- [Analyzing QBot/QakBot Malware With Zeek](https://drkeithjones.com/index.php/2023/08/16/analyzing-qbot-qakbot-with-zeek/) - In this short article I'll outline some analysis I performed on the QBot/QakBot malware family with Zeek.
- [Detecting njRAT/Bladabindi Malware With Zeek - Zeek Roulette #1](https://drkeithjones.com/index.php/2023/04/20/detecting-njrat-bladabindi-malware-with-zeek-zeek-roulette-1/) - Welcome to the first edition of Zeek Roulette, where I pick a random Zeek topic and try to solve it! For this article I picked njRAT malware from Any.Run and tried to write a detector for it. There is a copy of the njRAT malware, PCAP, and its analysis available here: https://app.any.run/tasks/72f74893-b9dc-4b1d-9d55-39e0eae86bda/# If you download
- [Zeek Log Format Cheat Sheet](https://drkeithjones.com/index.php/2023/09/14/zeek-log-format-cheat-sheet/) - Sometimes you want to know what the format of a Zeek log is. Check out this web page that links to all the native Zeek log record definitions.
- [A Gozi Banking Malware Detector - Zeek Roulette #3](https://drkeithjones.com/index.php/2023/07/27/a-gozi-banking-malware-detector-zeek-roulette-3/) - I had talked about Gozi malware in our eCrimeBytes podcast here: Last Man From Gozi Banking Malware Group Sentenced To Three Years – eCrimeBytes Nibble #51 In my technical real life job at Corelight, I ran into a sample of the Gozi banking malware in the wild here: https://malware-traffic-analysis.net/2023/07/12/index.html You can download a PCAP of
- [njRAT/Bladabindi Zeek Detector Update - Zeek Roulette #1 Part 2](https://drkeithjones.com/index.php/2023/05/22/njrat-bladabindi-zeek-detector-update-zeek-roulette-1-part-2/) - This is an update to: Detecting njRAT/Bladabindi Malware With Zeek – Zeek Roulette #1 I have been running this detector on a live network for a while and I've seen 2 (rare) categories of false positives we can easily eliminate by improving on the code just a little bit. The first false positive occurs when
- [How To Make Your Voice Sound Sexy Using A USB Microphone On A MacBook](https://drkeithjones.com/index.php/2023/05/04/how-to-make-your-voice-sound-pimp-using-a-usb-microphone-on-a-macbook/) - This method will let you make your voice sound sexy through any application like Zoom, Microsoft Teams, StreamYard, etc. After installing OBS, you will need to install the donationware Virtual Audio Cable application from: https://vb-audio.com/Cable/ If you select this virtual cable as your output, anything that uses it as input will hear your output. It's
- [Using Logitech Brio In 4K In OBS On A 2019 Intel MacBook Pro](https://drkeithjones.com/index.php/2023/04/06/using-logitech-brio-in-4k-in-obs-on-a-2019-intel-macbook-pro/) - I do a fair amount of recording for my YouTube channel on a MacBook Pro, circa 2019. It has the Intel chip. Nothing I found online worked exactly for me when I used OBS, so here are the settings that worked for me, in case they are useful for someone else. First, put the cable
- [Zeek Clustering How-To Video](https://drkeithjones.com/index.php/2023/03/28/zeek-clustering-how-to-video/) - I put together a Zeek clustering video over at Youtube (https://youtu.be/g-QvpYHgh1c). You can get to the slides through: https://docs.google.com/presentation/d/1HHHF4-FNhoSuy-YPMOWka3EGvfOW7CJAFeS9VHxBg_E/edit?usp=sharing The source code is available at: https://github.com/corelight/CVE-2022-24491
- [How To Connect Zeek To Python](https://drkeithjones.com/index.php/2023/03/11/how-to-connect-zeek-to-python/) - I was recently asked how to send data from Zeek to Python. After flipping through the Zeek Broker documentation I couldn't find a good example to reference, so here is my example. The code for this demo is available here: https://github.com/keithjjones/zeek-python-broker-demo The first piece of our source code is the Python program here: https://github.com/keithjjones/zeek-python-broker-demo/blob/master/broker-test.py There
- [Using Zeek Signatures To Detect CVEs](https://drkeithjones.com/index.php/2023/03/23/using-zeek-signatures-to-detect-cves/) - I put a video together (https://www.youtube.com/watch?v=PcXjkUt3rZA) discussing a method I have used to detect CVEs using just Zeek signatures: https://docs.zeek.org/en/master/frameworks/signatures.html This method is useful when trying to detect a CVE exploit in a protocol that is not fully parsed by Zeek. In this video we discuss a CVE for portmapper, which is a protocol not
- [Create a Zeek Spicy Analyzer from a Template](https://drkeithjones.com/index.php/2023/02/21/create-a-zeek-spicy-analyzer-from-a-template/) - Learn how to create a Zeek Spicy protocol analyzer from a template using "zkg create". Youtube: https://youtube.com/watch?v=bYRavdBxMsM&feature=shares Slides: https://docs.google.com/presentation/d/1A1B1h4lSh7SuUmcgOLDcw9ECQunWUvLhCz2k7DQqO4o/edit?usp=sharing
- [Easily Run Zeek and Spicy in a Docker Container](https://drkeithjones.com/index.php/2023/02/22/easily-run-zeek-and-spicy-in-a-docker-container/) - Here you will learn to run Zeek and Spicy in a Docker container. I do this often to test my code on different versions of Zeek without having to fully install each version. https://youtu.be/s5XT71sx47I Slides: https://docs.google.com/presentation/d/1zZqG7GjTh_cafqa6NQ86J4TW71mnEF7oK2HfkLqifvI/edit?usp=sharing
- [BACNet Basics With Zeek](https://drkeithjones.com/index.php/2023/02/23/bacnet-basics-with-zeek/) - We look at what BACNet traffic looks like in Zeek, along the way explaining some BACNet basics. https://youtu.be/C1y6UY_ithk Slides: https://docs.google.com/presentation/d/1mlUrkSQqI1cES8ma-ZV2Qp62xWpBOL6IkHIKqIQ-niw/edit?usp=sharing
- [Anatomy Of A Zeek Spicy Protocol Analyzer](https://drkeithjones.com/index.php/2023/02/27/anatomy-of-a-zeek-spicy-protocol-analyzer/) - This video will walk through all the important parts of a Zeek Spicy protocol analyzer. Slides: https://docs.google.com/presentation/d/17PZEH5G04RGtb78WDiCZjSTl58EKh_WmztzVdzo0eME/edit?usp=sharing https://youtu.be/wmm-6ZggwNc
- [Understanding The Zeek Spicy Wireguard VPN Protocol Analyzer](https://drkeithjones.com/index.php/2023/03/06/understanding-the-zeek-spicy-wireguard-vpn-protocol-analyzer/) - In this presentation I walk through every line of code in the open source Zeek Spicy Wireguard VPN protocol analyzer. It's more fun than it sounds, honestly. Spicy documentation: https://docs.zeek.org/projects/spicy/en/latest/index.html Slides: https://docs.google.com/presentation/d/1LOCtYEr8cJ_DLqcjJoyUu1g7-iQbOjS45AnDjzknL7U/edit?usp=sharing
- [Industrial Control Systems (ICS) PCAP Resources For Zeek And Wireshark](https://drkeithjones.com/index.php/2023/03/10/industrial-control-systems-ics-pcap-resources-for-zeek-and-wireshark/) - In this video I walk through several resources to download ICS protocol PCAPs: https://www.netresec.com/?page=PCAP4SICS https://www.netresec.com/?page=PcapFiles https://github.com/automayt/ICS-pcap https://www.icsdefense.net/pcap https://github.com/mmguero-dev/Malcolm-PCAP https://github.com/ControlThings-io/ct-samples/tree/master/Protocols https://kargs.net/captures/ https://www.controlthings.io/resources https://docs.google.com/spreadsheets/d/1G3WStQJpTKe6DfQlq7knpZSK8AcxG4eQDj1HLk8LZq0/edit#gid=0
- [YouTube Video For How To Connect Zeek To Python Is Up!](https://drkeithjones.com/index.php/2023/03/12/youtube-video-for-how-to-connect-zeek-to-python-is-up/) - Here is a short video I put together to show how to pass PCAP data from Zeek through Python and back to Zeek. The original instructions I wrote can be found here: How To Connect Zeek To Python Subscribe and like if you would like to see more!
- [Zeek Spicy OSPF Packet Analyzer Update - v0.1.4](https://drkeithjones.com/index.php/2023/03/14/zeek-spicy-ospf-packet-analyzer-update-v0-1-4/) - An update in the packet analyzer now makes it Zeek v5.2 ready. You can view more here: https://github.com/corelight/zeek-spicy-ospf You can install the latest version with the following command: zkg install zeek-spicy-ospf
- [My Zeek How-To Video Playlist](https://drkeithjones.com/index.php/2023/03/14/my-zeek-how-to-video-playlist/) - Here is a playlist I put together of just my Zeek How-To videos:
- [Zeek Spicy IPSec Protocol Analyzer Update - v0.2.17](https://drkeithjones.com/index.php/2023/03/15/zeek-spicy-ipsec-protocol-analyzer-update-v0-2-17/) - An update in the protocol analyzer now makes it Zeek v5.2 ready. You can view more here: https://github.com/corelight/zeek-spicy-ipsec You can install the latest version with the following command: zkg install zeek-spicy-ipsec
- [How To Profile A Zeek Spicy Protocol Analyzer](https://drkeithjones.com/index.php/2023/03/16/how-to-profile-a-zeek-spicy-protocol-analyzer/) - This is a good page over at the Zeek Spicy Wiki on how to profile protocol analyzers: https://github.com/zeek/spicy/wiki/Performance-profiling-of-Spicy-parsers
- [Zeek's suspend_processing Quirk With PCAPs](https://drkeithjones.com/index.php/2023/03/21/zeeks-suspend_processing-quirk-with-pcaps/) - In the comments of an earlier blog: ... we found an interesting situation. Even when you call "suspend_processing" in zeek_init, like this: event zeek_init() &priority=10 { suspend_processing(); } event new_connection(c: connection) { print("NEW"); } event connection_state_remove(c: connection) { print("REMOVE"); } ... Zeek will still process the first packet. The "new_connection" and "connection_state_remove" events will still
- [Welcome!](https://drkeithjones.com/index.php/2023/02/21/welcome/) - This is my first post. I hope there will be many more to come. Feel free to visit any of my social media links in the header.

## Pages

- [My Publications](https://drkeithjones.com/index.php/my-publications/) - Come check out some of the things I have published.
- [My Tools](https://drkeithjones.com/index.php/my-tools/) - This page contains the tools I have written or that I have had a significant hand in writing. Visit my GitHub link in the social media menu for more tools! LLM Tools LLM-Ninja - Scripts to help you use an LLM AI model like a ninja. https://github.com/corelight/LLM-Ninja Zeek Related Tools zeek2es - A Python application
- [Privacy Policy](https://drkeithjones.com/index.php/privacy-policy/) - Last updated: September 07, 2023 This Privacy Policy describes Our policies and procedures on the collection, use and disclosure of Your information when You use the Service and tells You about Your privacy rights and how the law protects You. We use Your Personal data to provide and improve the Service. By using the Service,
- [Expert Testimony](https://drkeithjones.com/index.php/expert-testimony/) - Expert Testimony, “State of Tennessee v. Barbara Potter and Jenelle Potter”, Case 39553B Jonesborough Criminal Court, Washington County, Tennessee – May 2015 Expert Testimony, “In re Motors Liquidation Company, et al., f/k/a General Motors Corporation, et al., Case No. 09-50026 and Motors Liquidation Company GUC Trust v. Appaloosa Investment Limited Partnership I, et al., Adversary

## Categories

- [General](https://drkeithjones.com/index.php/category/general/)
- [Zeek](https://drkeithjones.com/index.php/category/zeek/)
- [Spicy](https://drkeithjones.com/index.php/category/spicy/)
- [zkg](https://drkeithjones.com/index.php/category/zkg/)
- [Docker](https://drkeithjones.com/index.php/category/docker/)
- [ICS](https://drkeithjones.com/index.php/category/ics/)
- [BACNet](https://drkeithjones.com/index.php/category/bacnet/)
- [VPN](https://drkeithjones.com/index.php/category/vpn/)
- [Wireguard](https://drkeithjones.com/index.php/category/wireguard/)
- [PCAPs](https://drkeithjones.com/index.php/category/pcaps/)
- [Python](https://drkeithjones.com/index.php/category/python/)
- [Electronic Crime](https://drkeithjones.com/index.php/category/electronic-crime/)
- [Tools](https://drkeithjones.com/index.php/category/tools/)
- [Theft](https://drkeithjones.com/index.php/category/theft/)
- [How-To](https://drkeithjones.com/index.php/category/how-to/)
- [IPSec](https://drkeithjones.com/index.php/category/ipsec/)
- [Open Source](https://drkeithjones.com/index.php/category/open-source/)
- [CVE](https://drkeithjones.com/index.php/category/cve/)
- [Insider](https://drkeithjones.com/index.php/category/insider/)
- [National Secrets](https://drkeithjones.com/index.php/category/national-secrets/)
- [Malware](https://drkeithjones.com/index.php/category/malware/)
- [Detection](https://drkeithjones.com/index.php/category/detection/)
- [Zeek Roulette](https://drkeithjones.com/index.php/category/zeek/zeek-roulette/)
- [AI](https://drkeithjones.com/index.php/category/ai/)
- [Ransomware](https://drkeithjones.com/index.php/category/ransomware/)
- [Drone](https://drkeithjones.com/index.php/category/drone/)
- [Computer Forensics](https://drkeithjones.com/index.php/category/computer-forensics/)
- [Unpack the PCAP](https://drkeithjones.com/index.php/category/unpackthepcap/)
- [DuckDB](https://drkeithjones.com/index.php/category/duckdb/)
- [Wireshark](https://drkeithjones.com/index.php/category/wireshark/)