Tools: csv_dissector_V0_0_2.zip.
Blog post: Lua CSV Wireshark Dissector
howto
Decoding Cobalt Strike Traffic
Tools: parse-cs-http-traffic.py, 1768.py, pecheck.py and pybeacon.
ISC diary entry: Decoding Cobalt Strike Traffic
YARA and CyberChef: ZIP
YARA and CyberChef
Finding Metasploit & Cobalt Strike URLs
oledump and YARA DDE Rules
Tools: oledump.py, YARA.
NVISO blog post: Detecting DDE in MS Office documents
ISC diary entry: DDE and oledump
tshark & Malware Analysis
pdftool.py: Incremental Updates
Tool: pdftool.py
Blog posts: Solving a Little PDF Puzzle, Shoulder Surfing a Malicious PDF Author, New Tool: pdftool.py.
Doc & RTF Malicious Document
CyberChef: Analyzing OOXML Files for URLs
Tools: CyberChef
CyberChef Recipe: here
Sample: f84b3a056abcbcfd5976afe8776a35c5894b379e65c411ddc421941d3a2a4b8b
ISC diary entry: Doc & RTF Malicious Document
Didier Stevens Videos 