Tag: SANS Internet Storm Center, InfoCON: green

Increasing Searches for ZIP Files, (Thu, Aug 28th)

I noticed recently that we have more and more requests for ZIP files in our web honeypot logs. Over the last year, we have had a substantial increase in these requests. This article has been indexed from SANS Internet Storm…

Interesting Technique to Launch a Shellcode, (Wed, Aug 27th)

In most attack scenarios, attackers have to perform a crucial operation: to load a shellcode in memory and execute it. This is often performed in a three-step process: This article has been indexed from SANS Internet Storm Center, InfoCON: green…

CVE-2017-11882 Will Never Die, (Wed, Aug 13th)

One of the key messages broadcasted by security professionals is: “Patch, patch and patch again!”. But they are nasty vulnerabilities that remain exploited by attackers even if they are pretty old. %%cve:2017-11882%% is one of them: this remote code execution…

Microsoft August 2025 Patch Tuesday, (Tue, Aug 12th)

This month's Microsoft patch update addresses a total of 111 vulnerabilities, with 17 classified as critical. Among these, one vulnerability was disclosed prior to the patch release, marking it as a zero-day. While none of the vulnerabilities have been exploited…

Google Paid Ads for Fake Tesla Websites, (Sun, Aug 10th)

In recent media events, Tesla has demoed progressively more sophisticated versions of its Optimus robots. The sales pitch is pretty simple: “Current AI” is fun, but what we really need is not something to create more funny kitten pictures. We…

Do sextortion scams still work in 2025?, (Wed, Aug 6th)

Sextortion e-mails have been with us for quite a while, and these days, most security professionals tend to think of them more in terms of an “e-mail background noise” rather than as if they posed any serious threat. Given that…

New Feature: Daily Trends Report, (Mon, Aug 4th)

I implemented a new report today, the “Daily Trends” report. It summarizes noteworthy data received from our honeypot. As with everything, it will improve if you provide feedback :) This article has been indexed from SANS Internet Storm Center, InfoCON:…

Legacy May Kill, (Sun, Aug 3rd)

Just saw something that I thought was long gone. The username “pop3user” is showing up in our telnet/ssh logs. I don't know how long ago it was that I used POP3 to retrieve e-mail from one of my mail servers.…

Scattered Spider Related Domain Names, (Thu, Jul 31st)

This week, CISA updated its advisory on Scattered Spider. Scattered Spider is a threat actor using social engineering tricks to access target networks. The techniques used by Scattered Spider replicate those used by other successful actors, such as Lapsus$. Social…

Apple Updates Everything: July 2025, (Tue, Jul 29th)

Apple today released updates for iOS, iPadOS, macOS, watchOS, tvOS, and visionOS. This is a feature release, but it includes significant security updates. Apple patches a total of 29 different vulnerabilities. None of these vulnerabilities has been identified as exploited. …

Triage is Key! Python to the Rescue!, (Tue, Jul 29th)

When you need to quickly analyze a lot of data, there is one critical step to perform: Triage. In forensic investigations, this step is critical because it allows investigators to quickly identify, prioritize, and isolate the most relevant or high…

Parasitic Sharepoint Exploits, (Mon, Jul 28th)

Last week, newly exploited SharePoint vulnerabilities took a lot of our attention. It is fair to assume that last Monday (July 21st), all exposed vulnerable SharePoint installs were exploited. Of course, there is nothing to prevent multiple exploitation of the…

New Tool: ficheck.py, (Thu, Jul 24th)

As I mention every time I teach FOR577, I have been a big fan of file integrity monitoring tools (FIM) since Gene Kim first released Tripwire well over 30 years ago. I've used quite a few of them over the…

Wireshark 4.4.8 Released, (Tue, Jul 22nd)

Wireshark release 4.4.8 fixes 9 bugs. This article has been indexed from SANS Internet Storm Center, InfoCON: green Read the original article: Wireshark 4.4.8 Released, (Tue, Jul 22nd)

WinRAR MoTW Propagation Privacy, (Tue, Jul 22nd)

Since WinRAR 7.10, not all Mark-of-The-Web data (stored in the Zone.Identifier Alternate Data Stream) is propagated when you extract a file from an archive. This article has been indexed from SANS Internet Storm Center, InfoCON: green Read the original article:…

Veeam Phishing via Wav File, (Fri, Jul 18th)

A interesting phishing attempt was reported by a contact. It started with a simple email that looked like a voice mail notification like many VoIP systems deliver when the call is missed. There was a WAV file attached to the…

Hiding Payloads in Linux Extended File Attributes, (Thu, Jul 17th)

This week, it's SANSFIRE[1]! I'm attending the FOR577[2] training (“Linux Incident Response & Threat Hunting”). On day 2, we covered the different filesystems and how data is organized on disk. In the Linux ecosystem, most filesystems (ext3, ext4, xfs, …)…

More Free File Sharing Services Abuse, (Wed, Jul 16th)

A few months ago, I wrote a diary about online services used to exfiltrate data[1]. In this diary, I mentioned some well-known services. One of them was catbox.moe[2]. Recently, I found a sample that was trying to download some payload…

Keylogger Data Stored in an ADS, (Tue, Jul 15th)

If many malware samples try to be “filess” (read: they try to reduce their filesystem footprint to the bare minimum), another technique remains interesting: Alternate Data Streams or “ADS”[1]. This NTFS feature allows files to contain multiple data streams, enabling…

DShield Honeypot Log Volume Increase, (Mon, Jul 14th)

The volume of honeypot logs changes over time. Very rarely are honeypot logs quiet, meaning that there are no internet scans or malicious activity generating logs. Honeypots can see large increases in activity [1], but this has tended to be…

Experimental Suspicious Domain Feed, (Sun, Jul 13th)

We have had a “newly registered domain” feed for a few years. This feed pulls data from ICANN's centralized zone data service (https://czds.icann.org) and TLS certificate transparency logs. This article has been indexed from SANS Internet Storm Center, InfoCON: green…

Microsoft Patch Tuesday, July 2025, (Tue, Jul 8th)

Today, Microsoft released patches for 130 Microsoft vulnerabilities and 9 additional vulnerabilities not part of Microsoft's portfolio but distributed by Microsoft. 14 of these are rated critical. Only one of the vulnerabilities was disclosed before being patched, and none of the vulnerabilities…

What’s My (File)Name?, (Mon, Jul 7th)

Modern malware implements a lot of anti-debugging and anti-analysis features. Today, when a malware is spread in the wild, there are chances that it will be automatically sent into a automatic analysis pipe, and a sandbox. To analyze a sample…

Scans for Ichano AtHome IP Cameras, (Mon, Jun 23rd)

Ichano's “AtHome Camera” is a bit of a different approach to home surveillance cameras [1]. Instead of a hardware camera solution, this product is a software solution that turns existing devices like computers and tablets into webcams. The software implements…


ADS & Python Tools, (Sat, Jun 21st)

Ehsaan Mavani talks about Alternate Data Streams (ADS) in diary entry “Alternate Data Streams ? Adversary Defense Evasion and Detection [Guest Diary]”. This article has been indexed from SANS Internet Storm Center, InfoCON: green Read the original article: 
ADS &…

ADS & Python Tools, (Sat, Jun 21st)

Ehsaan Mavani talks about Alternate Data Streams (ADS) in diary entry “Alternate Data Streams ? Adversary Defense Evasion and Detection [Guest Diary]”. This article has been indexed from SANS Internet Storm Center, InfoCON: green Read the original article: ADS &…

A JPEG With A Payload, (Mon, Jun 16th)

Over the weekend, Xavier posted about another image with a payload: “More Steganography!”. This article has been indexed from SANS Internet Storm Center, InfoCON: green Read the original article: A JPEG With A Payload, (Mon, Jun 16th)

More Steganography!, (Sat, Jun 14th)

I spotted another interesting file that uses, once again, steganography. It seems to be a trend (see one of my previous diaries[1]). The file is an malicious Excel sheet called blcopy.xls. Office documents are rare these days because Microsoft improved…