Category: SANS Internet Storm Center, InfoCON: green

Apple Updates Everything: July 2025, (Tue, Jul 29th)

Apple today released updates for iOS, iPadOS, macOS, watchOS, tvOS, and visionOS. This is a feature release, but it includes significant security updates. Apple patches a total of 29 different vulnerabilities. None of these vulnerabilities has been identified as exploited. …

Triage is Key! Python to the Rescue!, (Tue, Jul 29th)

When you need to quickly analyze a lot of data, there is one critical step to perform: Triage. In forensic investigations, this step is critical because it allows investigators to quickly identify, prioritize, and isolate the most relevant or high…

Parasitic Sharepoint Exploits, (Mon, Jul 28th)

Last week, newly exploited SharePoint vulnerabilities took a lot of our attention. It is fair to assume that last Monday (July 21st), all exposed vulnerable SharePoint installs were exploited. Of course, there is nothing to prevent multiple exploitation of the…

New Tool: ficheck.py, (Thu, Jul 24th)

As I mention every time I teach FOR577, I have been a big fan of file integrity monitoring tools (FIM) since Gene Kim first released Tripwire well over 30 years ago. I've used quite a few of them over the…

WinRAR MoTW Propagation Privacy, (Tue, Jul 22nd)

Since WinRAR 7.10, not all Mark-of-The-Web data (stored in the Zone.Identifier Alternate Data Stream) is propagated when you extract a file from an archive. This article has been indexed from SANS Internet Storm Center, InfoCON: green Read the original article:…

Veeam Phishing via Wav File, (Fri, Jul 18th)

A interesting phishing attempt was reported by a contact. It started with a simple email that looked like a voice mail notification like many VoIP systems deliver when the call is missed. There was a WAV file attached to the…

Hiding Payloads in Linux Extended File Attributes, (Thu, Jul 17th)

This week, it's SANSFIRE[1]! I'm attending the FOR577[2] training (“Linux Incident Response & Threat Hunting”). On day 2, we covered the different filesystems and how data is organized on disk. In the Linux ecosystem, most filesystems (ext3, ext4, xfs, …)…

Keylogger Data Stored in an ADS, (Tue, Jul 15th)

If many malware samples try to be “filess” (read: they try to reduce their filesystem footprint to the bare minimum), another technique remains interesting: Alternate Data Streams or “ADS”[1]. This NTFS feature allows files to contain multiple data streams, enabling…

DShield Honeypot Log Volume Increase, (Mon, Jul 14th)

The volume of honeypot logs changes over time. Very rarely are honeypot logs quiet, meaning that there are no internet scans or malicious activity generating logs. Honeypots can see large increases in activity [1], but this has tended to be…

Experimental Suspicious Domain Feed, (Sun, Jul 13th)

We have had a “newly registered domain” feed for a few years. This feed pulls data from ICANN's centralized zone data service (https://czds.icann.org) and TLS certificate transparency logs. This article has been indexed from SANS Internet Storm Center, InfoCON: green…

Microsoft Patch Tuesday, July 2025, (Tue, Jul 8th)

Today, Microsoft released patches for 130 Microsoft vulnerabilities and 9 additional vulnerabilities not part of Microsoft's portfolio but distributed by Microsoft. 14 of these are rated critical. Only one of the vulnerabilities was disclosed before being patched, and none of the vulnerabilities…

What’s My (File)Name?, (Mon, Jul 7th)

Modern malware implements a lot of anti-debugging and anti-analysis features. Today, when a malware is spread in the wild, there are chances that it will be automatically sent into a automatic analysis pipe, and a sandbox. To analyze a sample…

Scans for Ichano AtHome IP Cameras, (Mon, Jun 23rd)

Ichano's “AtHome Camera” is a bit of a different approach to home surveillance cameras [1]. Instead of a hardware camera solution, this product is a software solution that turns existing devices like computers and tablets into webcams. The software implements…


ADS & Python Tools, (Sat, Jun 21st)

Ehsaan Mavani talks about Alternate Data Streams (ADS) in diary entry “Alternate Data Streams ? Adversary Defense Evasion and Detection [Guest Diary]”. This article has been indexed from SANS Internet Storm Center, InfoCON: green Read the original article: 
ADS &…

ADS & Python Tools, (Sat, Jun 21st)

Ehsaan Mavani talks about Alternate Data Streams (ADS) in diary entry “Alternate Data Streams ? Adversary Defense Evasion and Detection [Guest Diary]”. This article has been indexed from SANS Internet Storm Center, InfoCON: green Read the original article: ADS &…

A JPEG With A Payload, (Mon, Jun 16th)

Over the weekend, Xavier posted about another image with a payload: “More Steganography!”. This article has been indexed from SANS Internet Storm Center, InfoCON: green Read the original article: A JPEG With A Payload, (Mon, Jun 16th)

More Steganography!, (Sat, Jun 14th)

I spotted another interesting file that uses, once again, steganography. It seems to be a trend (see one of my previous diaries[1]). The file is an malicious Excel sheet called blcopy.xls. Office documents are rare these days because Microsoft improved…

Microsoft Patch Tuesday June 2025, (Tue, Jun 10th)

Microsoft today released patches for 67 vulnerabilities. 10 of these vulnerabilities are rated critical. One vulnerability has already been exploited and another vulnerability has been publicly disclosed before today. This article has been indexed from SANS Internet Storm Center, InfoCON:…


OctoSQL & Vulnerability Data, (Sun, Jun 8th)

This post doesn’t have text content, please click on the link below to view the original article. This article has been indexed from SANS Internet Storm Center, InfoCON: green Read the original article: 
OctoSQL & Vulnerability Data, (Sun, Jun 8th)

OctoSQL & Vulnerability Data, (Sun, Jun 8th)

This post doesn’t have text content, please click on the link below to view the original article. This article has been indexed from SANS Internet Storm Center, InfoCON: green Read the original article: OctoSQL & Vulnerability Data, (Sun, Jun 8th)

Wireshark 4.4.7 Released, (Sun, Jun 8th)

Wireshark release 4.4.7 fixes 1 vulnerability (%%cve:2025-5601%%) and 8 bugs. This article has been indexed from SANS Internet Storm Center, InfoCON: green Read the original article: Wireshark 4.4.7 Released, (Sun, Jun 8th)

Extracting With pngdump.py, (Sun, Jun 8th)

Inspired by Xavier's diary entry “A PNG Image With an Embedded Gift”, I updated my pngdump.py program to enable the extraction of chunks and extra data (similar to my other analysis tools, like pngdump.py). This article has been indexed from…

Be Careful With Fake Zoom Client Downloads, (Thu, Jun 5th)

Collaborative tools are really popular these days. Since the COVID-19 pandemic, many people switched to remote work positions and we need to collaborate with our colleagues or customers every day. Tools like Microsoft Teams, Zoom, WebEx, (name your best solution),…

Simple SSH Backdoor, (Mon, Jun 2nd)

For most system and network administrators, the free SSH client Putty has been their best friend for years! This tool was also (ab)used by attackers that deployed a trojanized version[1]. Microsoft had the good idea to include OpenSSH (beta version)…

YARA 4.5.3 Release, (Sun, Jun 1st)

YARA 4.5.3 was released with 5 bugfixes. This article has been indexed from SANS Internet Storm Center, InfoCON: green Read the original article: YARA 4.5.3 Release, (Sun, Jun 1st)

A PNG Image With an Embedded Gift, (Sat, May 31st)

While hunting, I found an interesting picture. It's a PNG file that was concatenated with two interesting payloads. There are file formats that are good candidates to have data added at the end of the file. PNG is the case…

Usage of “passwd” Command in DShield Honeypots, (Fri, May 30th)

DShield honeypots [1] receive different types of attack traffic and the volume of that traffic can change over time. I've been collecting data from a half dozen honeypots for a little over a year to make comparisons. This data includes: …

SVG Steganography, (Mon, May 26th)

Didier recently published several diaries related to steganography. I have to admit that steganography isn't exactly my favorite topic. It is one of those “neat” infosec toys, but its applicability is limited. Data exfiltration usually does not require proper steganography,…

Researchers Scanning the Internet, (Tue, May 20th)

We have been using our data to identify researchers scanning the internet for a few years. Currently, we are tracking 36 groups performing such scans, and our data feed of the IP addresses used contains around 33k addresses [1]. …