Tag: SANS Internet Storm Center, InfoCON: green

CrowdStrike Outage Themed Maldoc, (Mon, Jul 29th)

2024-07-29 01:07

I found a malicious Word document with VBA code using the CrowdStrike outage for social engineering purposes. It&#x26;#39;s an .ASD file (AutoRecover file). My tool oledump.py can analyze it: This article has been indexed from SANS Internet Storm Center, InfoCON:…

Quickie: Password Cracking & Energy, (Sun, Jul 28th)

2024-07-29 00:07

When Johannes talked about my diary entry “Protected OOXML Spreadsheets” on his StormCast podcast, he mentioned that I privately shared data on the power consumption of my desktop with a NVIDIA GeForce RTX 3080 GPU when running Hashcat. This article…

Create Your Own BSOD: NotMyFault, (Sat, Jul 27th)

2024-07-27 19:07

With all the Blue Screen Of Death screenshots we saw lately, I got the idea to write about Sysinternals&#x26;#39; tool NotMyFault. This article has been indexed from SANS Internet Storm Center, InfoCON: green Read the original article: Create Your Own…

ExelaStealer Delivered “From Russia With Love”, (Fri, Jul 26th)

2024-07-26 13:07

Some simple PowerShell scripts might deliver nasty content if executed by the target. I found a very simple one (with a low VT score of 8/65): This article has been indexed from SANS Internet Storm Center, InfoCON: green Read the…

ISC Stormcast For Friday, July 26th, 2024 https://isc.sans.edu/podcastdetail/9070, (Fri, Jul 26th)

2024-07-26 03:07

This post doesn’t have text content, please click on the link below to view the original article. This article has been indexed from SANS Internet Storm Center, InfoCON: green Read the original article: ISC Stormcast For Friday, July 26th, 2024…

XWorm Hidden With Process Hollowing, (Thu, Jul 25th)

2024-07-25 08:07

XWorm is not a brand-new malware family&#x26;#x5b;1&#x26;#x5d;. It&#x26;#39;s a common RAT (Remote Access Tool) re-use regularly in new campaigns. Yesterday, I found a sample that behaves like a dropper and runs the malware using the Process Hollowing technique&#x26;#x5b;2&#x26;#x5d;. The sample…

ISC Stormcast For Thursday, July 25th, 2024 https://isc.sans.edu/podcastdetail/9068, (Thu, Jul 25th)

2024-07-25 03:07

“Mouse Logger” Malicious Python Script, (Wed, Jul 24th)

2024-07-24 08:07

Keylogging is a&#x26;#xc2;&#x26;#xa0;pretty common feature of many malware families because recording the key pressed on a keyboard may reveal a lot of interesting information like usernames, passwords, etc. Back from SANSFIRE, I looked at my backlog of hunting results and…

ISC Stormcast For Wednesday, July 24th, 2024 https://isc.sans.edu/podcastdetail/9066, (Wed, Jul 24th)

2024-07-24 03:07

New Exploit Variation Against D-Link NAS Devices (CVE-2024-3273), (Tue, Jul 23rd)

2024-07-23 17:07

In April, an OS command injection vulnerability in various D-Link NAS devices was made public [1]. The vulnerability, %%CVE:2024-3273%% was exploited soon after it became public. Many of the affected devices are no longer supported. This article has been indexed…

ISC Stormcast For Tuesday, July 23rd, 2024 https://isc.sans.edu/podcastdetail/9064, (Tue, Jul 23rd)

2024-07-23 03:07

CrowdStrike: The Monday After, (Mon, Jul 22nd)

2024-07-22 14:07

Last Friday, after Crowdstrike released a bad sensor configuration update that caused widespread crashes of Windows systems. The most visible effects of these crashes appear to have been mitigated. I am sure many IT workers had to spend the weekend…

ISC Stormcast For Monday, July 22nd, 2024 https://isc.sans.edu/podcastdetail/9062, (Mon, Jul 22nd)

2024-07-22 03:07

Widespread Windows Crashes Due to Crowdstrike Updates, (Fri, Jul 19th)

2024-07-19 12:07

Last night, endpoint security company Crowdstrike released an update that is causing widespread “blue screens of death” (BSOD) on Windows systems. Crowdstrike released an advisory, which is only available after logging into the Crowdstrike support platform. A brief public statement…

« 1 … 35 36 37 38 39 … 47 »