Category: SANS Internet Storm Center, InfoCON: green

New Tool: ficheck.py, (Thu, Jul 24th)

As I mention every time I teach FOR577, I have been a big fan of file integrity monitoring tools (FIM) since Gene Kim first released Tripwire well over 30 years ago. I've used quite a few of them over the…

WinRAR MoTW Propagation Privacy, (Tue, Jul 22nd)

Since WinRAR 7.10, not all Mark-of-The-Web data (stored in the Zone.Identifier Alternate Data Stream) is propagated when you extract a file from an archive. This article has been indexed from SANS Internet Storm Center, InfoCON: green Read the original article:…

Veeam Phishing via Wav File, (Fri, Jul 18th)

A interesting phishing attempt was reported by a contact. It started with a simple email that looked like a voice mail notification like many VoIP systems deliver when the call is missed. There was a WAV file attached to the…

Hiding Payloads in Linux Extended File Attributes, (Thu, Jul 17th)

This week, it's SANSFIRE[1]! I'm attending the FOR577[2] training (“Linux Incident Response & Threat Hunting”). On day 2, we covered the different filesystems and how data is organized on disk. In the Linux ecosystem, most filesystems (ext3, ext4, xfs, …)…

Keylogger Data Stored in an ADS, (Tue, Jul 15th)

If many malware samples try to be “filess” (read: they try to reduce their filesystem footprint to the bare minimum), another technique remains interesting: Alternate Data Streams or “ADS”[1]. This NTFS feature allows files to contain multiple data streams, enabling…