Tag: SANS Internet Storm Center, InfoCON: green

Sitecore “thumbnailsaccesstoken” Deserialization Scans (and some new reports) CVE-2025-27218, (Thu, Mar 27th)

2025-03-27 18:03

On March 6th, Searchlight Cyber published a blog revealing details about a new deserialization vulnerability in Sitecore &#x26;#x5b;1&#x26;#x5d;. Sitecore calls itself a “Digital Experience Platform (CXP),” which is a fancy content management system&#x26;#xc2;&#x26;#xa0;(CMS). Sitecore itself is written in .Net and…

ISC Stormcast For Thursday, March 27th, 2025 https://isc.sans.edu/podcastdetail/9382, (Thu, Mar 27th)

2025-03-27 03:03

This post doesn’t have text content, please click on the link below to view the original article. This article has been indexed from SANS Internet Storm Center, InfoCON: green Read the original article: ISC Stormcast For Thursday, March 27th, 2025…

ISC Stormcast For Wednesday, March 26th, 2025 https://isc.sans.edu/podcastdetail/9380, (Wed, Mar 26th)

2025-03-26 03:03

[Guest Diary] Leveraging CNNs and Entropy-Based Feature Selection to Identify Potential Malware Artifacts of Interest, (Wed, Mar 26th)

2025-03-26 01:03

&#x26;#x5b;This is a Guest Diary by Wee Ki Joon, an ISC intern as part of the SANS.edu Bachelor&#x26;#39;s Degree in Applied Cybersecurity (BACS) program &#x26;#x5b;1].] This article has been indexed from SANS Internet Storm Center, InfoCON: green Read the original…

X-Wiki Search Vulnerability exploit attempts (CVE-2024-3721), (Tue, Mar 25th)

2025-03-25 16:03

Creating a secure Wiki is hard. The purpose of a wiki is to allow “random” users to edit web pages. A good Wiki provides users with great flexibility, but with great flexibility comes an even “greater” attack surface. File uploads…

ISC Stormcast For Tuesday, March 25th, 2025 https://isc.sans.edu/podcastdetail/9378, (Tue, Mar 25th)

2025-03-25 03:03

Privacy Aware Bots, (Mon, Mar 24th)

2025-03-24 15:03

Staring long enough at honeypot logs, I am sure you will come across one or the other “oddity.” Something that at first does not make any sense, but then, in some way, does make sense. After looking at the Next.js…

ISC Stormcast For Monday, March 24th, 2025 https://isc.sans.edu/podcastdetail/9376, (Mon, Mar 24th)

2025-03-24 03:03

Let’s Talk About HTTP Headers., (Sun, Mar 23rd)

2025-03-23 18:03

Walking my dog earlier, I came across the sign on the right. Having just looked at yet another middleware/HTTP header issue (the Next.js problem that became public this weekend) [1], I figured I should write something about HTTP headers. We…

ISC Stormcast For Friday, March 21st, 2025 https://isc.sans.edu/podcastdetail/9374, (Fri, Mar 21st)

2025-03-21 03:03

Some new Data Feeds, and a little “incident”., (Thu, Mar 20th)

2025-03-20 20:03

Our API (https://isc.sans.edu/api) continues to be quite popular. One query we see a lot is lookups for individual IP addresses. Running many queries as you go through a log may cause you to get locked out by our rate limit.…

ISC Stormcast For Thursday, March 20th, 2025 https://isc.sans.edu/podcastdetail/9372, (Thu, Mar 20th)

2025-03-20 03:03

Exploit Attempts for Cisco Smart Licensing Utility CVE-2024-20439 and CVE-2024-20440, (Wed, Mar 19th)

2025-03-19 15:03

In September, Cisco published an advisory noting two vulnerabilities [1]: This article has been indexed from SANS Internet Storm Center, InfoCON: green Read the original article: Exploit Attempts for Cisco Smart Licensing Utility CVE-2024-20439 and CVE-2024-20440, (Wed, Mar 19th)

ISC Stormcast For Wednesday, March 19th, 2025 https://isc.sans.edu/podcastdetail/9370, (Wed, Mar 19th)

2025-03-19 03:03

Python Bot Delivered Through DLL Side-Loading, (Tue, Mar 18th)

2025-03-18 09:03

One of my hunting rules triggered some suspicious Python code, and, diving deeper, I found an interesting example of DLL side-loading. This technique involves placing a malicious DLL with the same name and export structure as a legitimate DLL in…

ISC Stormcast For Tuesday, March 18th, 2025 https://isc.sans.edu/podcastdetail/9368, (Tue, Mar 18th)

2025-03-18 03:03

Static Analysis of GUID Encoded Shellcode, (Mon, Mar 17th)

2025-03-17 09:03

I wanted to figure out how to statically decode the GUID encoded shellcode Xavier wrote about in his diary entry “Shellcode Encoded in UUIDs”. This article has been indexed from SANS Internet Storm Center, InfoCON: green Read the original article:…

ISC Stormcast For Monday, March 17th, 2025 https://isc.sans.edu/podcastdetail/9366, (Mon, Mar 17th)

2025-03-17 03:03

Mirai Bot now incroporating (malformed?) DrayTek Vigor Router Exploits, (Sun, Mar 16th)

2025-03-16 22:03

Last October, Forescout published a report disclosing several vulnerabilities in DrayTek routers. According to Forescount, about 700,000 devices were exposed to these vulnerabilities [1]. At the time, DrayTek released firmware updates for affected routers [2]. Forescout also noted that multiple…

ISC Stormcast For Friday, March 14th, 2025 https://isc.sans.edu/podcastdetail/9364, (Fri, Mar 14th)

2025-03-14 03:03

ISC Stormcast For Thursday, March 13th, 2025 https://isc.sans.edu/podcastdetail/9362, (Thu, Mar 13th)

2025-03-13 03:03

File Hashes Analysis with Power BI from Data Stored in DShield SIEM, (Wed, Mar 12th)

2025-03-13 02:03

I previously used Power BI [2] to analyze DShield sensor data and this time I wanted to show how it could be used by selecting certain type of data as a large dataset and export it for analysis. This time,…

Scans for VMWare Hybrid Cloud Extension (HCX) API (Log4j – not brute forcing), (Wed, Mar 12th)

2025-03-12 16:03

Today, I noticed increased scans for the VMWare Hyprid Cloud Extension (HCX) “sessions” endpoint. These endpoints are sometimes associated with exploit attempts for various VMWare vulnerabilities to determine if the system is running the extensions or to gather additional information…

Scans for VMWare Hybrid Cloud Extension (HCX) API (Brutefording Credentials?), (Wed, Mar 12th)

2025-03-12 15:03

ISC Stormcast For Wednesday, March 12th, 2025 https://isc.sans.edu/podcastdetail/9360, (Wed, Mar 12th)

2025-03-12 03:03

Microsoft Patch Tuesday: March 2025, (Tue, Mar 11th)

2025-03-11 19:03

The March patch Tuesday looks like a fairly light affair, with only 51 vulnerabilities total and only six rated as critical. However, this patch Tuesday also includes six patches for already exploited, aka “0-Day” vulnerabilities. None of the already exploited…

ISC Stormcast For Tuesday, March 11th, 2025 https://isc.sans.edu/podcastdetail/9358, (Tue, Mar 11th)

2025-03-11 03:03

Shellcode Encoded in UUIDs, (Mon, Mar 10th)

2025-03-10 09:03

I returned from another FOR610[1] class last week in London. One key tip I give to my students is to keep an eye on “strange” API calls. In the Windows ecosystem, Microsoft offers tons of API calls to developers. The…

ISC Stormcast For Monday, March 10th, 2025 https://isc.sans.edu/podcastdetail/9356, (Mon, Mar 10th)

2025-03-10 03:03

Commonly Probed Webshell URLs, (Sun, Mar 9th)

2025-03-09 16:03

Looking over some weblogs on my way back from class in Baltimore, I feel a reminder is appropriate that (a) weblogs are still a thing and (b) what some of the common webshells are that attackers are looking for. This…

ISC Stormcast For Friday, March 7th, 2025 https://isc.sans.edu/podcastdetail/9354, (Fri, Mar 7th)

2025-03-07 04:03

ISC Stormcast For Thursday, March 6th, 2025 https://isc.sans.edu/podcastdetail/9352, (Thu, Mar 6th)

2025-03-06 04:03

DShield Traffic Analysis using ELK, (Thu, Mar 6th)

2025-03-06 02:03

Using the Kibana interface, sometimes it can be difficult to find traffic of interest since there can be so much of it. The 3 logs used for traffic analysis are cowrie, webhoneypot and the firewall logs. Other options to add…

ISC Stormcast For Wednesday, March 5th, 2025 https://isc.sans.edu/podcastdetail/9350, (Wed, Mar 5th)

2025-03-05 03:03

Romanian Distillery Scanning for SMTP Credentials, (Tue, Mar 4th)

2025-03-04 17:03

Lately, attackers have gotten more creative and aggressive in trying to find various credential files on exposed web servers. Our “First Seen” page each day shows many new versions of scans for secrets files like “.env”. This article has…

Tool update: mac-robber.py, (Tue, Mar 4th)

2025-03-04 15:03

Just a quick update. I fixed a big bug in my mac-robber.py script about 2 weeks ago, but realized I hadn&#x26;#39;t published a diary about it. I didn&#x26;#39;t go back and figure out how this one slipped in because I&#x26;#39;m…

ISC Stormcast For Tuesday, March 4th, 2025 https://isc.sans.edu/podcastdetail/9348, (Tue, Mar 4th)

2025-03-04 03:03

Mark of the Web: Some Technical Details, (Mon, Mar 3rd)

2025-03-03 12:03

The Mark of the Web (MoTW) is file metadata in Windows that marks a file that was obtained from an untrusted source. This article has been indexed from SANS Internet Storm Center, InfoCON: green Read the original article: Mark of…

ISC Stormcast For Monday, March 3rd, 2025 https://isc.sans.edu/podcastdetail/9346, (Mon, Mar 3rd)

2025-03-03 03:03

Wireshark 4.4.5 Released, (Sun, Mar 2nd)

2025-03-02 09:03

Wireshark release 4.4.5 was released soon after 4.4.4 : it fixes a bug that makes Wireshark crash when clicking on a column title/header. This article has been indexed from SANS Internet Storm Center, InfoCON: green Read the original article: Wireshark…

ISC Stormcast For Friday, February 28th, 2025 https://isc.sans.edu/podcastdetail/9344, (Fri, Feb 28th)

2025-02-28 03:02

Njrat Campaign Using Microsoft Dev Tunnels, (Thu, Feb 27th)

2025-02-27 09:02

I spotted new Njrat[1] samples that (ab)use the Microsoft dev tunnels[2] service to connect to their C2 servers. This is a service that allows developers to expose local services to the Internet securely for testing, debugging, and collaboration. It provides…

ISC Stormcast For Thursday, February 27th, 2025 https://isc.sans.edu/podcastdetail/9342, (Thu, Feb 27th)

2025-02-27 03:02

[Guest Diary] Malware Source Servers: The Threat of Attackers Using Ephemeral Ports as Service Ports to Upload Data, (Wed, Feb 26th)

2025-02-26 03:02

&#x26;#x5b;This is a Guest Diary by Robin Zaheer, an ISC intern as part of the SANS.edu Bachelor&#x26;#39;s Degree in Applied Cybersecurity (BACS) program &#x26;#x5b;1].] This article has been indexed from SANS Internet Storm Center, InfoCON: green Read the original article:…

ISC Stormcast For Wednesday, February 26th, 2025 https://isc.sans.edu/podcastdetail/9340, (Wed, Feb 26th)

2025-02-26 03:02

ISC Stormcast For Tuesday, February 25th, 2025 https://isc.sans.edu/podcastdetail/9338, (Tue, Feb 25th)

2025-02-25 03:02

Unfurl v2025.02 released, (Mon, Feb 24th)

2025-02-24 22:02

I&#x26;#39;ve been a big fan of Ryan Benson&#x26;#39;s unfurl[1] tool since he released it a little over 5 years ago. Unfurl is a tool that can parse/decode URLs including things like embedded timestamps and IP addresses. It can be run…

ISC Stormcast For Monday, February 24th, 2025 https://isc.sans.edu/podcastdetail/9336, (Mon, Feb 24th)

2025-02-24 03:02

Wireshark 4.4.4 Released, (Sun, Feb 23rd)

2025-02-23 12:02

Wireshark release 4.4.4 fixes 1 vulnerability (%%CVE:2025-1492%%) and 12 bugs. This article has been indexed from SANS Internet Storm Center, InfoCON: green Read the original article: Wireshark 4.4.4 Released, (Sun, Feb 23rd)

ISC Stormcast For Friday, February 21st, 2025 https://isc.sans.edu/podcastdetail/9334, (Fri, Feb 21st)

2025-02-21 02:02

Tool update: sigs.py – added check mode, (Fri, Feb 21st)

2025-02-21 01:02

Over the years, I&#x26;#39;ve written a number of scripts to make my life easier. One of those tools was sigs.py (which was a rewrite of an old perl script sigs.pl) to hash files. I wanted something portable that could potentially…

Using ES|QL in Kibana to Queries DShield Honeypot Logs, (Thu, Feb 20th)

2025-02-20 03:02

With the Elastic released of version 8.17.0, it included “The technical preview of new MATCH and query string (QSTR) functions in ES|QL makes log searches easier and more intuitive.”[1] With this released, I started exploring some of the many options…

ISC Stormcast For Thursday, February 20th, 2025 https://isc.sans.edu/podcastdetail/9332, (Thu, Feb 20th)

2025-02-20 03:02

XWorm Cocktail: A Mix of PE data with PowerShell Code, (Wed, Feb 19th)

2025-02-19 09:02

While hunting, I spent some time trying to deobfuscate a malicious file discovered on VT. It triggered my PowerShell rule. At the end, I found two files that look close together: This article has been indexed from SANS Internet Storm…

ISC Stormcast For Wednesday, February 19th, 2025 https://isc.sans.edu/podcastdetail/9330, (Wed, Feb 19th)

2025-02-19 02:02

https://SecTemplates.com – simplified, free open-source templates to enable engineering and smaller security teams to bootstrap security capabilities for their organizations, (Tue, Feb 18th)

2025-02-18 20:02

SecTemplates.com – simplified, free open-source templates to enable engineering and smaller security teams to bootstrap security capabilities for their organizations, (Tue, Feb 18th)

2025-02-18 19:02

ISC Stormcast For Tuesday, February 18th, 2025 https://isc.sans.edu/podcastdetail/9328, (Tue, Feb 18th)

2025-02-18 03:02

ModelScan – Protection Against Model Serialization Attacks, (Mon, Feb 17th)

2025-02-18 02:02

Protect AI&#x27s OSS portfolio includes tools aimed at improving security of AI/ML software. These tools are meant for a wide range of engineering, security and ML practitioners including developers, security engineers/researchers, ML engineers, LLM engineers and prompt engineers, and data…

My Very Personal Guidance and Strategies to Protect Network Edge Devices, (Thu, Feb 6th)

2025-02-17 14:02

Last week, CISA and other national cyber security organizations published an extensive document outlining “Guidance and Strategies to Protect Network Edge Devices.” &#x26;#x5b;1&#x26;#x5d;&#x26;#xc2;&#x26;#xa0;The document is good but also very corporate and “bland.” It summarizes good, well-intended advice that will help…

ISC Stormcast For Monday, February 17th, 2025 https://isc.sans.edu/podcastdetail/9326, (Mon, Feb 17th)

2025-02-17 02:02

The Danger of IP Volatility, (Sat, Feb 15th)

2025-02-15 08:02

What do I mean by â€œIP volatilityâ€? Today, many organizations use cloud services and micro-services. In such environments, IP addresses assigned to virtual machines or services can often be volatile, meaning they can change or be reassigned to other organizations…

Fake BSOD Delivered by Malicious Python Script, (Fri, Feb 14th)

2025-02-14 13:02

I found a Python script that implements a funny anti-analysis trick. The script has a low score on VT (4/59) (SHA256:d716c2edbcdb76c6a6d31b21f154fee7e0f8613617078b69da69c8f4867c9534)&#x26;#x5b;1&#x26;#x5d;. This sample attracted my attention because it uses the tkinter&#x26;#x5b;2&#x26;#x5d; library.&#x26;#xc2;&#x26;#xa0;This&#x26;#xc2;&#x26;#xa0;library&#x26;#xc2;&#x26;#xa0;is used to create graphical user interfaces (GUIs). It…

ISC Stormcast For Friday, February 14th, 2025 https://isc.sans.edu/podcastdetail/9324, (Fri, Feb 14th)

2025-02-14 03:02

DShield SIEM Docker Updates, (Thu, Feb 13th)

2025-02-13 02:02

Over the past several weeks, I have been testing various enhancements to the DShield SIEM, to process DShield sensor log from local and cloud sensors with Filebeat and Filebeat modules to easily send Zeek and NetFlow logs back to a…

ISC Stormcast For Thursday, February 13th, 2025 https://isc.sans.edu/podcastdetail/9322, (Thu, Feb 13th)

2025-02-13 02:02

ISC Stormcast For Wednesday, February 12th, 2025 https://isc.sans.edu/podcastdetail/9320, (Wed, Feb 12th)

2025-02-12 03:02

An ontology for threats, cybercrime and digital forensic investigation on Smart City Infrastructure, (Wed, Feb 12th)

2025-02-12 03:02

Blue teams have it hard â€“ they maintain a watchful eye on whatever technology is deployed to detect threats, respond to incidents, perform digital forensics and reverse malware (or make malware happy!) when needed. Hopefully, no one has to handle…

Microsoft February 2025 Patch Tuesday, (Tue, Feb 11th)

2025-02-11 21:02

This month, Microsoft has released patches addressing a total of 141 vulnerabilities. Among these, 4 are classified as critical, highlighting the potential for significant impact if exploited. Notably, 2 vulnerabilities are currently being exploited in the wild, underscoring the urgency…


Reminder: 7-Zip & MoW, (Mon, Feb 10th)

2025-02-11 03:02

CVE-2025-0411 is a vulnerability in 7-zip that has been reported to be exploited in recent attacks. The problem is that Mark-of-Web (MoW) isn&#x26;#39;t propagated correctly: when extracted, a file inside a ZIP file inside another ZIP file will not have…

ISC Stormcast For Tuesday, February 11th, 2025 https://isc.sans.edu/podcastdetail/9318, (Tue, Feb 11th)

2025-02-11 03:02

Reminder: 7-Zip & MoW, (Mon, Feb 10th)

2025-02-10 08:02

ISC Stormcast For Monday, February 10th, 2025 https://isc.sans.edu/podcastdetail/9316, (Mon, Feb 10th)

2025-02-10 03:02

Crypto Wallet Scam: Not For Free, (Sat, Feb 8th)

2025-02-08 20:02

I did some research into multisig wallets (cfr “Crypto Wallet Scam”), and discovered that setting up such a wallet on the TRON network comes with a cost: about $23. This article has been indexed from SANS Internet Storm Center, InfoCON:…

SSL 2.0 turns 30 this Sunday… Perhaps the time has come to let it die?, (Fri, Feb 7th)

2025-02-07 12:02

The SSL 2.0 protocol was originally published back in February of 1995[1], and although it was quickly found to have significant security weaknesses, and a more secure alternative was released only a year later[2], it still received a fairly wide…

ISC Stormcast For Friday, February 7th, 2025 https://isc.sans.edu/podcastdetail/9314, (Fri, Feb 7th)

2025-02-07 02:02

The Unbreakable Multi-Layer Anti-Debugging System, (Thu, Feb 6th)

2025-02-06 09:02

The title of this diary is based on the string I found in a malicious Python script that implements many anti-debugging techniques. If some were common, others were interesting and demonstrated how low-level high-level languages like Python can access operating…

ISC Stormcast For Thursday, February 6th, 2025 https://isc.sans.edu/podcastdetail/9312, (Thu, Feb 6th)

2025-02-06 03:02

Phishing via “com-” prefix domains, (Wed, Feb 5th)

2025-02-05 19:02

Phishing is always a “whack the mole” like game. Attackers come up with new ways to fool victims. Security tools are often a step behind. Messages claiming to collect unpaid tolls are one current common theme among phishing (smishing?) messages.…

ISC Stormcast For Wednesday, February 5th, 2025 https://isc.sans.edu/podcastdetail/9310, (Wed, Feb 5th)

2025-02-05 03:02

Some updates to our data feeds, (Tue, Feb 4th)

2025-02-04 17:02

We have offered several different data feeds via our API or other means. However, we are often not very good at documenting what these feeds are all about. Currently, I am in the process of fixing the documentation around these…

ISC Stormcast For Tuesday, February 4th, 2025 https://isc.sans.edu/podcastdetail/9308, (Tue, Feb 4th)

2025-02-04 03:02

Crypto Wallet Scam, (Mon, Feb 3rd)

2025-02-03 09:02

Johannes noticed a SPAM comment on his YouTube channel: This article has been indexed from SANS Internet Storm Center, InfoCON: green Read the original article: Crypto Wallet Scam, (Mon, Feb 3rd)

ISC Stormcast For Monday, February 3rd, 2025 https://isc.sans.edu/podcastdetail/9306, (Mon, Feb 3rd)

2025-02-03 03:02

To Simulate or Replicate: Crafting Cyber Ranges, (Fri, Jan 31st)

2025-01-31 05:01

The Good Stuff First This tool is being shared (calling it a tool is generous) due to the number of times last year I had to create fake internet domains. It adds domains and zones to Windows DNS. This was…

ISC Stormcast For Friday, January 31st, 2025 https://isc.sans.edu/podcastdetail/9304, (Fri, Jan 31st)

2025-01-31 03:01

PCAPs or It Didn’t Happen: Exposing an Old Netgear Vulnerability Still Active in 2025 [Guest Diary], (Thu, Jan 30th)

2025-01-30 18:01

[This is a Guest Diary by David Watson, an ISC intern as part of the SANS.edu BACS program] This article has been indexed from SANS Internet Storm Center, InfoCON: green Read the original article: PCAPs or It Didn’t Happen: Exposing…

PCAPs or It Didn?t Happen: Exposing an Old Netgear Vulnerability Still Active in 2025 [Guest Diary], (Thu, Jan 30th)

2025-01-30 14:01

ISC Stormcast For Thursday, January 30th, 2025 https://isc.sans.edu/podcastdetail/9302, (Thu, Jan 30th)

2025-01-30 04:01

From PowerShell to a Python Obfuscation Race!, (Wed, Jan 29th)

2025-01-29 10:01

Attackers like to mix multiple technologies to improve the deployment of their malicious code. I spotted a small script that drops a Python malware. The file was sent on VirusTotal and got a score of 2/60![1] (SHA256:96bb0777a8e9616bc9ca22ca207cf434a947a3e4286c051ed98ddd39147b3c4f). The script starts…

Page 1 of 6

1 2 3 … 6 »