Collaborate Disseminate
Our honeypots saw a number of scans for “/j_acegi_security_check” the last two days. This URL has not been hit much lately, but was hit pretty hard last March. The URL is associated with Jenkins, and can be used to brute force passwords.
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, January 9th, 2024 https://isc.sans.edu/podcastdetail/8802, (Tue, Jan 9th)
Devices are connecting to different web resources on a regular basis. One method to identify what is connecting to a web resource is through a user agent [1] and many are received on DShield [2] honeypots.
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, January 8th, 2024 https://isc.sans.edu/podcastdetail/8800, (Mon, Jan 8th)
On the 31 Dec 2023, after trying multiple username/password combination, actor using IP 194.30.53.68 successfully loging to the honeypot and uploaded eight files where 2 of them are protected with a 7zip password (updates1.7z & updates2.7z). Some of these files have been identified to be related to the Prometei trojan by Virustotal. The file sqhost.exe [6] was last found by Talos [7] used with the Prometei botnet as a trojan coin miner.Â
Continue reading Suspicious Prometei Botnet Activity, (Sun, Jan 7th)
If many people can detect simple phishing emails these days, some attacks are very well crafted and also have built-in techniques not only to ensure that potential victims will fall into the trap but there is another aspect. From an attacker’s point of view, how to improve the quality of collected data?
Continue reading Are you sure of your password?, (Sat, Jan 6th)
I don&#;x26;#;39;t know about you, but in Windows I use netstat pretty frequently. Netstat is a great tool to see what is happening on your network interface – listening ports, tcp connections and so on. Common arguments are:
Continue reading Netstat, but Better and in PowerShell, (Fri, Jan 5th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, January 5th, 2024 https://isc.sans.edu/podcastdetail/8798, (Fri, Jan 5th)
The Wireshark Foundation has released 3 new versions of its popular network protocol analyzer. They are versions 4.2.1&#;x26;#;xc2;&#;x26;#;xa0;(which fixes 5 CVEs and a number of other bugs), 4.0.12&#;x26;#;xc2;&#;x26;#;xa0;(2 CVEs &#;x26;#;x2b; additional bugs), and 3.6.20&#;x26;#;xc2;&#;x26;#;xa0;(2 CVEs &#;x26;#;x2b; additional bugs). Version 4.2.0 was just released in November 2023, so if you haven&#;x26;#;39;t tried it out yet, here is your chance to upgrade.
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, January 4th, 2024 https://isc.sans.edu/podcastdetail/8796, (Thu, Jan 4th)