Collaborate Disseminate
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, June 3rd, 2024 https://isc.sans.edu/podcastdetail/9006, (Mon, Jun 3rd)
Python remains a nice language for attackers and I keep finding interesting scripts that are usually not very well detected by antivirus solutions. The one I found has a VT score of 7/65&#;x26;#;x21; (SHA256:a6230d4d00a9d8ecaf5133b02d9b61fe78283ac4826a8346b72b4482d9aab54c&#;x26;#;x5b;1&#;x26;#;x5d;). I decided to call it “k1w1” infostealer because this string is referenced in many variable&#;x26;#;xc2;&#;x26;#;xa0;and function names. The script has&#;x26;#;xc2;&#;x26;#;xa0;classic infostealer capabilities&#;x26;#;xc2;&#;x26;#;xa0;to find interesting pieces of data on the victim&#;x26;#;39;s computer but has some interesting techniques.&#;x26;#;xc2;&#;x26;#;xa0;
Continue reading “K1w1” InfoStealer Uses gofile.io for Exfiltration, (Fri, May 31st)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, May 31st, 2024 https://isc.sans.edu/podcastdetail/9004, (Fri, May 31st)
I&#;x26;#;39;m a big fan of OSSEC[1] for years. OSSEC (“Open Source Security Event Correlator”) is a comprehensive, open-source host-based intrusion detection system (HIDS). It is designed to monitor and analyze system logs, detect suspicious activities, and provide real-time alerts for security incidents. OSSEC can perform log analysis, file integrity monitoring, rootkit detection, and active response to mitigate threats. It supports various platforms including Linux, Windows, and macOS, and can be integrated with various security tools and SIEM solutions. I already wrote some diaries about it in the past[2]. I&#;x26;#;39;m running my instance on all my servers, I made some contributions to the project.
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, May 30th, 2024 https://isc.sans.edu/podcastdetail/9002, (Thu, May 30th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, May 29th, 2024 https://isc.sans.edu/podcastdetail/9000, (Wed, May 29th)
[This is a Guest Diary by Joshua Jobe, an ISC intern as part of the SANS.edu BACS program]
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, May 28th, 2024 https://isc.sans.edu/podcastdetail/8998, (Tue, May 28th)
Malicious e-mail attachments come in all shapes and sizes. In general, however, threat actors usually either send out files, which themselves carry a malicious payload â such as different scripts, Office documents or PDFs â or they send out âcontainersâ, which include such files â e.g., image files or archives. These container files, especially, can sometimes be quite unusual⦠Which is where today’s diary comes in.
Continue reading Files with TXZ extension used as malspam attachments, (Mon, May 27th)
YARA 4.5.0 was released with a small change to the regex syntax (allowing more whitespace) and many bugfixes.