The Cybersecurity Defenders Podcast #251 - Defender Fridays: Hunting Chinese State Actors with David Burkett from Corelight
Sep 26, 2025
David Burkett, a skilled Cloud Detection Engineer and Security Architect at Corelight, shares his extensive knowledge on hunting state-sponsored cyber threats, particularly focusing on recent CISA advisories regarding Chinese state actors. He discusses innovative techniques like using Zeek for detecting edge device exploitation, SSH fingerprinting, and tracking unusual traffic patterns. David also highlights the importance of correlating network telemetry with endpoint data to boost detection effectiveness and emphasizes the need for continuous learning and collaboration in the cybersecurity community.
AI Snips
Chapters
Transcript
Episode notes
EDR Pressure Shifts Adversary Tradeoffs
- EDR success has pushed adversaries to avoid endpoints and rely more on network-level techniques.
- This shift makes network detection and baselining management traffic increasingly valuable.
Baseline Management Protocols Immediately
- Baseline management protocols like TACACS on port 49 and alert on outbound traffic.
- Treat any unexpected external TACACS connections as a high-priority anomaly.
Hunt For PCAP Exfiltration
- Search Zeek/Con logs and SMB/files logs for PCAP or other captures being transferred outbound.
- Investigate any PCAP file transfers since they rarely should leave your network in the clear.