Malicious e-mail attachments come in all shapes and sizes. In general, however, threat actors usually either send out files, which themselves carry a malicious payload – such as different scripts, Office documents or PDFs – or they send out “containersâ€,…
Tag: SANS Internet Storm Center, InfoCON: green
YARA 4.5.1 Release, (Sun, May 26th)
YARA 4.5.0 was released with a small change to the regex syntax (allowing more whitespace) and many bugfixes. This article has been indexed from SANS Internet Storm Center, InfoCON: green Read the original article: YARA 4.5.1 Release, (Sun, May 26th)
csvkit, (Sat, May 25th)
After reading my diary entry “Checking CSV Files”, a reader informed me that CSV toolkit csvkit also contains a command to check CSV files: csvstat.py. This article has been indexed from SANS Internet Storm Center, InfoCON: green Read the original…
ISC Stormcast For Friday, May 24th, 2024 https://isc.sans.edu/podcastdetail/8996, (Fri, May 24th)
This post doesn’t have text content, please click on the link below to view the original article. This article has been indexed from SANS Internet Storm Center, InfoCON: green Read the original article: ISC Stormcast For Friday, May 24th, 2024…
ISC Stormcast For Thursday, May 23rd, 2024 https://isc.sans.edu/podcastdetail/8994, (Thu, May 23rd)
This post doesn’t have text content, please click on the link below to view the original article. This article has been indexed from SANS Internet Storm Center, InfoCON: green Read the original article: ISC Stormcast For Thursday, May 23rd, 2024…
Analysis of ?redtail? File Uploads to ICS Honeypot, a Multi-Architecture Coin Miner [Guest Diary], (Wed, May 22nd)
[This is a Guest Diary by Robert Riley, an ISC intern as part of the SANS.edu BACS program] This article has been indexed from SANS Internet Storm Center, InfoCON: green Read the original article: Analysis of ?redtail? File Uploads to…
NMAP Scanning without Scanning (Part 2) – The ipinfo API, (Wed, May 22nd)
Going back a year or so, I wrote a story on the passive recon, specifically the IPINFO API (https://isc.sans.edu/diary/28596). This API returns various information on an IP address: the registered owning organization and ASN, and a (usually reasonably accurate) approximation…
ISC Stormcast For Wednesday, May 22nd, 2024 https://isc.sans.edu/podcastdetail/8992, (Wed, May 22nd)
This post doesn’t have text content, please click on the link below to view the original article. This article has been indexed from SANS Internet Storm Center, InfoCON: green Read the original article: ISC Stormcast For Wednesday, May 22nd, 2024…
Scanning without Scanning with NMAP (APIs FTW), (Tue, May 21st)
A year ago I wrote up using Shodan's API to collect info on open ports and services without actually scanning for them (Shodan's API for the (Recon) Win!). This past week I was trolling through the NMAP scripts directory, and…
ISC Stormcast For Tuesday, May 21st, 2024 https://isc.sans.edu/podcastdetail/8990, (Tue, May 21st)
This post doesn’t have text content, please click on the link below to view the original article. This article has been indexed from SANS Internet Storm Center, InfoCON: green Read the original article: ISC Stormcast For Tuesday, May 21st, 2024…
Analyzing MSG Files, (Mon, May 20th)
.msg email files are ole files and can be analyzed with my tool oledump.py. This article has been indexed from SANS Internet Storm Center, InfoCON: green Read the original article: Analyzing MSG Files, (Mon, May 20th)
ISC Stormcast For Monday, May 20th, 2024 https://isc.sans.edu/podcastdetail/8988, (Mon, May 20th)
This post doesn’t have text content, please click on the link below to view the original article. This article has been indexed from SANS Internet Storm Center, InfoCON: green Read the original article: ISC Stormcast For Monday, May 20th, 2024…
Wireshark 4.2.5 Released, (Sat, May 18th)
Wireshark release 4.2.5 fixes 3 vulnerabilities (%%cve:2024-4853%%, %%cve:2024-4854%% and %%cve:2024-4855%%) and 19 bugs. This article has been indexed from SANS Internet Storm Center, InfoCON: green Read the original article: Wireshark 4.2.5 Released, (Sat, May 18th)
Another PDF Streams Example: Extracting JPEGs, (Fri, May 17th)
In my diary entry “Analyzing PDF Streams” I showed how to use my tools file-magic.py and myjson-filter.py together with my PDF analysis tool pdf-parser.py to analyze PDF streams en masse. This article has been indexed from SANS Internet Storm Center,…
ISC Stormcast For Friday, May 17th, 2024 https://isc.sans.edu/podcastdetail/8986, (Fri, May 17th)
This post doesn’t have text content, please click on the link below to view the original article. This article has been indexed from SANS Internet Storm Center, InfoCON: green Read the original article: ISC Stormcast For Friday, May 17th, 2024…
Why yq? Adventures in XML, (Thu, May 16th)
I was recently asked to “recover” a RADIUS key from a Microsoft NPS server.  No problem I think, just export the config and it's all there in clear text right? This article has been indexed from SANS Internet Storm Center,…
ISC Stormcast For Thursday, May 16th, 2024 https://isc.sans.edu/podcastdetail/8984, (Thu, May 16th)
This post doesn’t have text content, please click on the link below to view the original article. This article has been indexed from SANS Internet Storm Center, InfoCON: green Read the original article: ISC Stormcast For Thursday, May 16th, 2024…
Got MFA? If not, Now is the Time!, (Wed, May 15th)
I had an interesting call from a client recently – they had a number of “net use” and “psexec” commands pop up on a domain controller, all called from PSEXEC (thank goodness for a good EDR deployed across the board!!).…
ISC Stormcast For Wednesday, May 15th, 2024 https://isc.sans.edu/podcastdetail/8982, (Wed, May 15th)
This post doesn’t have text content, please click on the link below to view the original article. This article has been indexed from SANS Internet Storm Center, InfoCON: green Read the original article: ISC Stormcast For Wednesday, May 15th, 2024…
Microsoft May 2024 Patch Tuesday, (Tue, May 14th)
This month we got patches for 67 vulnerabilities. Of these, 1 are critical, and 1 is being exploited according to Microsoft. This article has been indexed from SANS Internet Storm Center, InfoCON: green Read the original article: Microsoft May 2024…