Tag: SANS Internet Storm Center, InfoCON: green

ISC Stormcast For Monday, October 21st, 2024 https://isc.sans.edu/podcastdetail/9188, (Mon, Oct 21st)

2024-10-21 03:10

This post doesn’t have text content, please click on the link below to view the original article. This article has been indexed from SANS Internet Storm Center, InfoCON: green Read the original article: ISC Stormcast For Monday, October 21st, 2024…

ISC Stormcast For Friday, October 18th, 2024 https://isc.sans.edu/podcastdetail/9186, (Fri, Oct 18th)

2024-10-18 03:10

ISC Stormcast For Thursday, October 17th, 2024 https://isc.sans.edu/podcastdetail/9184, (Thu, Oct 17th)

2024-10-17 03:10

Scanning Activity from Subnet 15.184.0.0/16, (Thu, Oct 17th)

2024-10-17 02:10

I noticed in my logs 2 weeks ago regular probe from a subnet in the Amazone cloud only scanning for TCP/8080 capture by the iptables of my DShield sensor. The scanning started on the 15 Aug – 4 Oct 2024…

The Top 10 Not So Common SSH Usernames and Passwords, (Wed, Oct 16th)

2024-10-16 18:10

Our list of “Top” ssh usernames and password is pretty static. Well known defaults, like “root” and “admin” are at the top of the list. But there are always some usernames and password in the list that are not as…

ISC Stormcast For Wednesday, October 16th, 2024 https://isc.sans.edu/podcastdetail/9182, (Wed, Oct 16th)

2024-10-16 03:10

Angular-base64-update Demo Script Exploited (CVE-2024-42640), (Tue, Oct 15th)

2024-10-15 16:10

Demo scripts left behind after installing applications or frameworks are an ongoing problem. After installation, removing any “demo” or “example” folders is usually best. A few days ago, Ravindu Wickramasinghe noticed that the Angular-base64-upload project is leaving behind a demo…

ISC Stormcast For Tuesday, October 15th, 2024 https://isc.sans.edu/podcastdetail/9180, (Tue, Oct 15th)

2024-10-15 03:10

Phishing Page Delivered Through a Blob URL, (Mon, Oct 14th)

2024-10-14 08:10

I receive a lot of spam in my catch-all mailboxes. If most of them are not interesting, some still attract my attention. Especially the one that I&#x26;#39;ll describe in this diary. The scenario is classic, an important document is pending…

ISC Stormcast For Monday, October 14th, 2024 https://isc.sans.edu/podcastdetail/9178, (Mon, Oct 14th)

2024-10-14 03:10

Wireshark 4.4.1 Released, (Sun, Oct 13th)

2024-10-13 07:10

Wireshark release 4.4.1 fixes 2 vulnerabilities and 27 bugs. One of these bugfixes is for the missing IP address plugin on Windows, see “Wireshark 4.4&#x26;#39;s IP Address Functions”. This article has been indexed from SANS Internet Storm Center, InfoCON: green…

ISC Stormcast For Friday, October 11th, 2024 https://isc.sans.edu/podcastdetail/9176, (Fri, Oct 11th)

2024-10-11 03:10

GPTHoney: A new class of honeypot [Guest Diary], (Thu, Oct 10th)

2024-10-10 04:10

[This is a Guest Diary by Christopher Schroeder, an ISC intern as part of the SANS.edu BACS program] This article has been indexed from SANS Internet Storm Center, InfoCON: green Read the original article: GPTHoney: A new class of honeypot…

ISC Stormcast For Thursday, October 10th, 2024 https://isc.sans.edu/podcastdetail/9174, (Thu, Oct 10th)

2024-10-10 03:10

From Perfctl to InfoStealer, (Wed, Oct 9th)

2024-10-09 08:10

A few days ago, a new stealthy malware targeting Linux hosts made a lot of noise: perfctl[1]. The malware has been pretty well analyzed and I won&#x27t repeat what has been already disclosed. I found a copy of the “httpd”…

ISC Stormcast For Wednesday, October 9th, 2024 https://isc.sans.edu/podcastdetail/9172, (Wed, Oct 9th)

2024-10-09 03:10

Microsoft Patch Tuesday – October 2024, (Tue, Oct 8th)

2024-10-08 20:10

Microsoft today released patches for 117 vulnerabilities. Three additional vulnerabilities apply to Chromium/Edge. Another three vulnerabilities are rated critical. This article has been indexed from SANS Internet Storm Center, InfoCON: green Read the original article: Microsoft Patch Tuesday – October…

ISC Stormcast For Tuesday, October 8th, 2024 https://isc.sans.edu/podcastdetail/9170, (Tue, Oct 8th)

2024-10-08 03:10

macOS Sequoia: System/Network Admins, Hold On!, (Mon, Oct 7th)

2024-10-07 17:10

It&#x26;#39;s always tempting to install the latest releases of your preferred software and operating systems. After all, that&#x26;#39;s the message we pass to our beloved users: “Patch, patch, and patch again!”. Last week, I was teaching for SANS and decided…

ISC Stormcast For Monday, October 7th, 2024 https://isc.sans.edu/podcastdetail/9168, (Mon, Oct 7th)

2024-10-07 03:10

Survey of CUPS exploit attempts, (Fri, Oct 4th)

2024-10-04 15:10

It is about a week since the release of the four CUPS remote code execution vulnerabilities. After the vulnerabilities became known, I configured one of our honeypots that watches a larger set of IPs to specifically collect UDP packets to…

ISC Stormcast For Friday, October 4th, 2024 https://isc.sans.edu/podcastdetail/9166, (Fri, Oct 4th)

2024-10-04 03:10

ISC Stormcast For Thursday, October 3rd, 2024 https://isc.sans.edu/podcastdetail/9164, (Thu, Oct 3rd)

2024-10-03 03:10

Kickstart Your DShield Honeypot [Guest Diary], (Thu, Oct 3rd)

2024-10-03 01:10

[This is a Guest Diary by Joshua Gilman, an ISC intern as part of the SANS.edu BACS program] This article has been indexed from SANS Internet Storm Center, InfoCON: green Read the original article: Kickstart Your DShield Honeypot [Guest Diary],…

Security related Docker containers, (Wed, Oct 2nd)

2024-10-02 19:10

Over the last 9 months or so, I&#x26;#39;ve been putting together some docker containers that I find useful in my day-to-day malware analysis and forensicating. I have been putting them up on hub.docker.com and decided, I might as well let…

ISC Stormcast For Wednesday, October 2nd, 2024 https://isc.sans.edu/podcastdetail/9162, (Wed, Oct 2nd)

2024-10-02 03:10

Hurricane Helene Aftermath – Cyber Security Awareness Month, (Tue, Oct 1st)

2024-10-01 15:10

For a few years now, October has been “National Cyber Security Awareness Month”. This year, it is a good opportunity for a refresher on some scams that tend to happen around disasters like Hurricane Helene. The bigger the disaster, the…

ISC Stormcast For Tuesday, October 1st, 2024 https://isc.sans.edu/podcastdetail/9160, (Tue, Oct 1st)

2024-10-01 03:10

Tool update: mac-robber.py and le-hex-to-ip.py, (Mon, Sep 30th)

2024-09-30 18:09

One of the problems I&#x26;#39;ve had since I originally wrote mac-robber.py [1][2][3] seven years ago is that because of the underlying os.stat python library we couldn&#x26;#39;t get file creation times (B-times). Since the release of GNU coreutils 8.32 (or so),…

ISC Stormcast For Monday, September 30th, 2024 https://isc.sans.edu/podcastdetail/9158, (Mon, Sep 30th)

2024-09-30 03:09

ISC Stormcast For Friday, September 27th, 2024 https://isc.sans.edu/podcastdetail/9156, (Fri, Sep 27th)

2024-09-27 03:09

Patch for Critical CUPS vulnerability: Don’t Panic, (Thu, Sep 26th)

2024-09-26 21:09

These last two days, a lot has been talked about a “Doomsday 9.9 RCE bug&#x26;#39;” in Linux [1]. We now have some additional details from Simone Margaritelli, who discovered and reported the vulnerabilities. This article has been indexed from SANS…

ISC Stormcast For Thursday, September 26th, 2024 https://isc.sans.edu/podcastdetail/9154, (Thu, Sep 26th)

2024-09-26 03:09

OSINT – Image Analysis or More Where, When, and Metadata [Guest Diary], (Wed, Sep 25th)

2024-09-26 02:09

[This is a Guest Diary by Thomas Spangler, an ISC intern as part of the SANS.edu BACS program] This article has been indexed from SANS Internet Storm Center, InfoCON: green Read the original article: OSINT – Image Analysis or More…

DNS Reflection Update and Odd Corrupted DNS Requests, (Wed, Sep 25th)

2024-09-25 18:09

Occasionally, I tend to check in on what reflective DNS denial of service attacks are doing. We usually see steady levels of attacks. Usually, they attempt to use spoofed requests for ANY records to achieve the highest possible amplification. Currently,…

ISC Stormcast For Wednesday, September 25th, 2024 https://isc.sans.edu/podcastdetail/9152, (Wed, Sep 25th)

2024-09-25 03:09

Exploitation of RAISECOM Gateway Devices Vulnerability CVE-2024-7120, (Tue, Sep 24th)

2024-09-24 15:09

Late in July, a researcher using the alias “NETSECFISH” published a blog post revealing a vulnerability in RASIECOM gateway devices [1]. The vulnerability affects the “vpn/list_base_Config.php” endpoint and allows for unauthenticated remote code execution. According to Shodan, about 25,000 vulnerable…

ISC Stormcast For Tuesday, September 24th, 2024 https://isc.sans.edu/podcastdetail/9150, (Tue, Sep 24th)

2024-09-24 03:09

Phishing links with @ sign and the need for effective security awareness building, (Mon, Sep 23rd)

2024-09-23 08:09

While going over a batch of phishing e-mails that were delivered to us here at the Internet Storm Center during the first half of September, I noticed one message which was somewhat unusual. Not because it was untypically sophisticated or…

ISC Stormcast For Monday, September 23rd, 2024 https://isc.sans.edu/podcastdetail/9148, (Mon, Sep 23rd)

2024-09-23 03:09

ISC Stormcast For Friday, September 20th, 2024 https://isc.sans.edu/podcastdetail/9146, (Fri, Sep 20th)

2024-09-20 03:09

Fake GitHub Site Targeting Developers, (Thu, Sep 19th)

2024-09-19 21:09

Our reader “RoseSecurity” forwarded received the following malicious email: This article has been indexed from SANS Internet Storm Center, InfoCON: green Read the original article: Fake GitHub Site Targeting Developers, (Thu, Sep 19th)

ISC Stormcast For Thursday, September 19th, 2024 https://isc.sans.edu/podcastdetail/9144, (Thu, Sep 19th)

2024-09-19 03:09

Time-to-Live Analysis of DShield Data with Vega-Lite, (Wed, Sep 18th)

2024-09-19 02:09

Since posting a diary about Vega-Lite [1], I have “played” with other queries that might be interesting and the first one that I wanted to explore since the DShield SIEM [2] capture and parse the iptables logs and store the…

Python Infostealer Patching Windows Exodus App, (Wed, Sep 18th)

2024-09-18 09:09

A few months ago, I wrote a diary[1] about a Python script that replaced the Exodus[2] Wallet app with a rogue one on macOS. Infostealers are everywhere these days. They target mainly browsers (cookies, credentials) and classic applications that may…

ISC Stormcast For Wednesday, September 18th, 2024 https://isc.sans.edu/podcastdetail/9142, (Wed, Sep 18th)

2024-09-18 03:09

23:59, Time to Exfiltrate!, (Tue, Sep 17th)

2024-09-17 08:09

Last week, I posted a diary about suspicious Python modules. One of them was Firebase [1], the cloud service provided by Google[2]. Firebase services abused by attackers is not new, usually, it&#x27s used to host malicious files that will be…

ISC Stormcast For Tuesday, September 17th, 2024 https://isc.sans.edu/podcastdetail/9140, (Tue, Sep 17th)

2024-09-17 03:09

Managing PE Files With Overlays, (Mon, Sep 16th)

2024-09-16 07:09

There is a common technique used by attackers: They append some data at the end of files (this is called an overlay). This can be used for two main reasons: To hide the appended data from the operating system (steganography).…

ISC Stormcast For Monday, September 16th, 2024 https://isc.sans.edu/podcastdetail/9138, (Mon, Sep 16th)

2024-09-16 03:09

YARA-X’s Dump Command, (Sun, Sep 15th)

2024-09-15 20:09

YARA-X is not just a rewrite of YARA in Rust, it comes with new features too. This article has been indexed from SANS Internet Storm Center, InfoCON: green Read the original article: YARA-X’s Dump Command, (Sun, Sep 15th)

YARA 4.5.2 Release, (Sat, Sep 14th)

2024-09-14 23:09

YARA 4.5.2 was released with 3 small changes and 4 bugfixes. This article has been indexed from SANS Internet Storm Center, InfoCON: green Read the original article: YARA 4.5.2 Release, (Sat, Sep 14th)

Finding Honeypot Data Clusters Using DBSCAN: Part 2, (Fri, Sep 13th)

2024-09-13 15:09

In an earlier diary [1], I reviewed how using tools like DBSCAN [2] can be useful to group similar data. I used DBSCAN to try and group similar commands submitted to Cowrie [3] and URL paths submitted to the DShield…

Finding Honeypot Data Clusters Using DBSCAN: Part 2, (Fri, Aug 23rd)

2024-09-13 14:09

ISC Stormcast For Friday, September 13th, 2024 https://isc.sans.edu/podcastdetail/9136, (Fri, Sep 13th)

2024-09-13 03:09

Hygiene, Hygiene, Hygiene! [Guest Diary], (Wed, Sep 11th)

2024-09-12 01:09

[This is a Guest Diary by Paul Olson, an ISC intern as part of the SANS.edu BACS program] This article has been indexed from SANS Internet Storm Center, InfoCON: green Read the original article: Hygiene, Hygiene, Hygiene! [Guest Diary], (Wed,…

Python Libraries Used for Malicious Purposes, (Wed, Sep 11th)

2024-09-11 08:09

Since I&#x27m interested in malicious Python scripts, I found multiple samples that rely on existing libraries. The most-known repository is probably pypi.org[1] that reports, as of today, 567,478 projects! Malware developers are like regular developers: They don&#x27t want to reinvent…

ISC Stormcast For Wednesday, September 11th, 2024 https://isc.sans.edu/podcastdetail/9134, (Wed, Sep 11th)

2024-09-11 03:09

Microsoft September 2024 Patch Tuesday, (Tue, Sep 10th)

2024-09-10 19:09

Today, Microsoft released its scheduled September set of patches. This update addresses 79 different vulnerabilities. Seven of these vulnerabilities are rated critical. Four vulnerabilities are already being exploited and have been made public. This article has been indexed from…

ISC Stormcast For Tuesday, September 10th, 2024 https://isc.sans.edu/podcastdetail/9132, (Tue, Sep 10th)

2024-09-10 04:09

Wireshark 4.4’s IP Address Functions, (Mon, Sep 9th)

2024-09-09 13:09

New IP address functions have been added in Wireshark 4.4 (if you use Wireshark on Windows, there&#x26;#39;s a bug in release 4.4.0: the DLL with these functions is missing, it will be included in release 4.4.1; all is fine with…


Password Cracking & Energy: More Dedails, (Sun, Sep 8th)

2024-09-09 04:09

Here are more details on the power consumption of my desktop computer when I crack passwords (cfr diary entry “Quickie: Password Cracking & Energy”). This article has been indexed from SANS Internet Storm Center, InfoCON: green Read the original article:…

ISC Stormcast For Monday, September 9th, 2024 https://isc.sans.edu/podcastdetail/9130, (Mon, Sep 9th)

2024-09-09 04:09


Python & Notepad++, (Sat, Sep 7th)

2024-09-08 16:09

PythonScript is a Notepad++ plugin that provides a Python interpreter to edit Notepad++ documents. This article has been indexed from SANS Internet Storm Center, InfoCON: green Read the original article: 
Python & Notepad++, (Sat, Sep 7th)

Password Cracking & Energy: More Dedails, (Sun, Sep 8th)

2024-09-08 16:09

Python & Notepad++, (Sat, Sep 7th)

2024-09-07 14:09

ISC Stormcast For Friday, September 6th, 2024 https://isc.sans.edu/podcastdetail/9128, (Fri, Sep 6th)

2024-09-06 03:09

Enrichment Data: Keeping it Fresh, (Fri, Sep 6th)

2024-09-06 01:09

I like to enrich my honeypot data from a variety of sources to help understand a bit more about the context of the attack. This includes the types of networks the attacks are coming from or whether malware submitted to…

ISC Stormcast For Thursday, September 5th, 2024 https://isc.sans.edu/podcastdetail/9126, (Thu, Sep 5th)

2024-09-05 04:09

Attack Surface [Guest Diary], (Wed, Sep 4th)

2024-09-05 02:09

[This is a Guest Diary by Joshua Tyrrell, an ISC intern as part of the SANS.edu BACS program] This article has been indexed from SANS Internet Storm Center, InfoCON: green Read the original article: Attack Surface [Guest Diary], (Wed, Sep…

Scans for Moodle Learning Platform Following Recent Update, (Wed, Sep 4th)

2024-09-04 16:09

On August 10th, the popular learning platform “Moodle” released an update fixing &#x26;#x25;&#x26;#x25;cve:2024-43425&#x26;#x25;&#x26;#x25;. RedTeam Pentesting found the vulnerability and published a detailed blog post&#x26;#xc2;&#x26;#xa0;late last week. The blog post demonstrates in detail how a user with the “trainer” role could…

ISC Stormcast For Wednesday, September 4th, 2024 https://isc.sans.edu/podcastdetail/9124, (Wed, Sep 4th)

2024-09-04 03:09

ISC Stormcast For Tuesday, September 3rd, 2024 https://isc.sans.edu/podcastdetail/9122, (Tue, Sep 3rd)

2024-09-03 03:09

Protected OOXML Text Documents, (Mon, Sep 2nd)

2024-09-02 21:09

Just like “Protected OOXML Spreadsheets”, Word documents can also be protected: This article has been indexed from SANS Internet Storm Center, InfoCON: green Read the original article: Protected OOXML Text Documents, (Mon, Sep 2nd)

Wireshark 4.4: Converting Display Filters to BPF Capture Filters, (Sun, Sep 1st)

2024-09-01 16:09

Display filters are used to define expressions that decide which packets get displayed, and which not in Wireshark&#x26;#39;s packet list. This article has been indexed from SANS Internet Storm Center, InfoCON: green Read the original article: Wireshark 4.4: Converting Display…

Wireshark 4.4.0 is now available, (Sat, Aug 31st)

2024-08-31 07:08

This is the first 4.4 release. Many new features have been added, details are here. This article has been indexed from SANS Internet Storm Center, InfoCON: green Read the original article: Wireshark 4.4.0 is now available, (Sat, Aug 31st)

ISC Stormcast For Friday, August 30th, 2024 https://isc.sans.edu/podcastdetail/9120, (Fri, Aug 30th)

2024-08-30 03:08

Simulating Traffic With Scapy, (Fri, Aug 30th)

2024-08-30 01:08

It can be helpful to simulate different kinds of system activity. I had an instance where I wanted to generate logs to test a log forwarding agent. This agent was processing DNS logs. There are a variety of ways that…

Live Patching DLLs with Python, (Thu, Aug 29th)

2024-08-29 08:08

In my previous diary[1], I explained why Python became popular for attackers. One of the given reason was that, from Python scripts, it&#x27s possible to call any Windows API and, therefore, perform low-level activities on the system. In another script,…

ISC Stormcast For Thursday, August 29th, 2024 https://isc.sans.edu/podcastdetail/9118, (Thu, Aug 29th)

2024-08-29 03:08

ISC Stormcast For Wednesday, August 28th, 2024 https://isc.sans.edu/podcastdetail/9116, (Wed, Aug 28th)

2024-08-28 03:08

Vega-Lite with Kibana to Parse and Display IP Activity over Time, (Tue, Aug 27th)

2024-08-28 02:08

I have been curious for a while looking at Kibana&#x26;#39;s Vega log parsing options to try to come up with displays and layout that aren&#x26;#39;t standard in Kibana. A lot of the potential layouts already exists in Kibana but some…

Why Is Python so Popular to Infect Windows Hosts?, (Tue, Aug 27th)

2024-08-27 11:08

It has been a while since I started to track how Python is used in the Windows eco-system&#x26;#x5b;1&#x26;#x5d;. Almost every day I find new pieces of malicious Python scripts. The programming language itself is not malicious. There are plenty of…

ISC Stormcast For Tuesday, August 27th, 2024 https://isc.sans.edu/podcastdetail/9114, (Tue, Aug 27th)

2024-08-27 03:08

From Highly Obfuscated Batch File to XWorm and Redline, (Mon, Aug 26th)

2024-08-26 08:08

If you follow my diaries, you probably already know that one of my favorite topics around malware is obfuscation. I&#x26;#39;m often impressed by the crazy techniques attackers use to make reverse engineers&#x26;#39; lives more difficult. Last week, I spotted a…

ISC Stormcast For Monday, August 26th, 2024 https://isc.sans.edu/podcastdetail/9112, (Mon, Aug 26th)

2024-08-26 03:08

Pandas Errors: What encoding are my logs in?, (Fri, Aug 23rd)

2024-08-23 13:08

While trying to process some of my honeypot data, I ran into the following error in my Python script: This article has been indexed from SANS Internet Storm Center, InfoCON: green Read the original article: Pandas Errors: What encoding are…

ISC Stormcast For Friday, August 23rd, 2024 https://isc.sans.edu/podcastdetail/9110, (Fri, Aug 23rd)

2024-08-23 03:08

OpenAI Scans for Honeypots. Artificially Malicious? Action Abuse?, (Thu, Aug 22nd)

2024-08-22 18:08

For a whille now, I have seen scans that contain the pattern “%%target%%” in the URL. For example, today this particular URL is popular: This article has been indexed from SANS Internet Storm Center, InfoCON: green Read the original article:…

ISC Stormcast For Thursday, August 22nd, 2024 https://isc.sans.edu/podcastdetail/9108, (Thu, Aug 22nd)

2024-08-22 02:08

ISC Stormcast For Wednesday, August 21st, 2024 https://isc.sans.edu/podcastdetail/9106, (Wed, Aug 21st)

2024-08-21 03:08

Mapping Threats with DNSTwist and the Internet Storm Center [Guest Diary], (Tue, Aug 20th)

2024-08-21 01:08

[This is a Guest Diary by Michael Tigges, an ISC intern as part of the SANS.edu BACS program] This article has been indexed from SANS Internet Storm Center, InfoCON: green Read the original article: Mapping Threats with DNSTwist and the…

Where are we with CVE-2024-38063: Microsoft IPv6 Vulnerability, (Tue, Aug 20th)

2024-08-20 15:08

I recorded a quick live stream with a quick update on CVE-2024-38063. The video focuses on determining the exploitability, particularly whether your systems are reachable by IPv6. This article has been indexed from SANS Internet Storm Center, InfoCON: green Read…

ISC Stormcast For Tuesday, August 20th, 2024 https://isc.sans.edu/podcastdetail/9104, (Tue, Aug 20th)

2024-08-20 03:08

Do you Like Donuts? Here is a Donut Shellcode Delivered Through PowerShell/Python, (Mon, Aug 19th)

2024-08-19 07:08

I found a tiny .bat file that looked not suspicious at all: 3650.bat (SHA256:bca5c30a413db21f2f85d7297cf3a9d8cedfd662c77aacee49e821c8b7749290) with a very low VirusTotal score (2/65)[1]. The file is very simple, it invokes a PowerShell: This article has been indexed from SANS Internet Storm Center,…

« 1 2 3 4 5 6 »