tracehound

Overview ¶

Command tracehound is a passive network sensor: it reads packets from a capture file or an interface, assembles them into flows, fingerprints TLS clients, and reports attacker behaviour mapped to MITRE ATT&CK.