Category: SANS Internet Storm Center, InfoCON: green

Keylogger Data Stored in an ADS, (Tue, Jul 15th)

If many malware samples try to be “filess” (read: they try to reduce their filesystem footprint to the bare minimum), another technique remains interesting: Alternate Data Streams or “ADS”[1]. This NTFS feature allows files to contain multiple data streams, enabling…

Read more →

DShield Honeypot Log Volume Increase, (Mon, Jul 14th)

The volume of honeypot logs changes over time. Very rarely are honeypot logs quiet, meaning that there are no internet scans or malicious activity generating logs. Honeypots can see large increases in activity [1], but this has tended to be…

Read more →

Experimental Suspicious Domain Feed, (Sun, Jul 13th)

We have had a “newly registered domain” feed for a few years. This feed pulls data from ICANN's centralized zone data service (https://czds.icann.org) and TLS certificate transparency logs. This article has been indexed from SANS Internet Storm Center, InfoCON: green…

Read more →

What’s My (File)Name?, (Mon, Jul 7th)

Modern malware implements a lot of anti-debugging and anti-analysis features. Today, when a malware is spread in the wild, there are chances that it will be automatically sent into a automatic analysis pipe, and a sandbox. To analyze a sample…

Read more →

Microsoft Patch Tuesday, July 2025, (Tue, Jul 8th)

Today, Microsoft released patches for 130 Microsoft vulnerabilities and 9 additional vulnerabilities not part of Microsoft's portfolio but distributed by Microsoft. 14 of these are rated critical. Only one of the vulnerabilities was disclosed before being patched, and none of the vulnerabilities…

Read more →