Collaborate Disseminate
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, January 4th, 2024 https://isc.sans.edu/podcastdetail/8796, (Thu, Jan 4th)
At the end of a year, or at the beginning of a new one, I like to go over all malicious attachments that were caught in my e-mail trap over the last 12 months, since this can provide a good overview of long-term malspam trends and may sometimes lead to other interesting discoveries. Over the years, I found that, at a minimum, it is usually instructive to look at what the largest and the smallest pieces of malware that one managed to catch were[1]. This held true even for 2023, as both the smallest and the largest sample I had turned out to be interesting in their own right. But let’s start at the beginningâ¦
Continue reading Interesting large and small malspam attachments from 2023, (Wed, Jan 3rd)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, January 3rd, 2024 https://isc.sans.edu/podcastdetail/8794, (Wed, Jan 3rd)
For HTTP, logging and fingerprinting browser user agents is standard practice. Many anti-automation tricks use the user agent and compare it to other browser artifacts, for example, supported JavaScript APIs, to detect bots. SSH offers an “identification string” with a format mandated by RFC 4253.
Continue reading Fingerprinting SSH Identification Strings, (Tue, Jan 2nd)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, January 2nd, 2024 https://isc.sans.edu/podcastdetail/8792, (Tue, Jan 2nd)
During the holiday season, I&#;x26;#;39;ve tried many different self-hosting solutions. But one of the most basic options is setting up a Pi-Hole DNS for your home. While the installation is pretty easy, I wanted to use docker on my Pi4, which would be an excellent way to get started. Having this as a docker would allow me to quickly redeploy if there was an issue, as DNS is crucial.
Continue reading Pi-Hole Pi4 Docker Deployment, (Sun, Dec 31st)
[This is a Guest Diary by Elias Bou Zeid, an ISC intern as part of the SANS.edu BACS program]
I found another Python keylogger… This is pretty common because Python has plenty of modules to implement this technique in a few lines of code:
Continue reading Python Keylogger Using Mailtrap.io, (Sat, Dec 23rd)
Our youngest readers won’t probably not get the point with this quote, it’s from the 1983 movie âWarGamesâ[1]. I used this subject because I found yesterday a small game in Python that offers not only some fun but also malicious code that will exfiltrate your browser data!
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, December 22nd, 2023 https://isc.sans.edu/podcastdetail/8790, (Fri, Dec 22nd)