Author Archives: SANS Internet Storm Center, InfoCON: green

Collecting and analyzing DNS logs should be at the top of your agenda regarding network monitoring. Everything that happens on the network tends to be reflected in DNS, and events that do not correlate with DNS are often suspect themselves. For example, if a host connects to an IP address directly without first receiving it as a DNS response. But in recent years, DNS has moved more and more to encrypted channels. Starting with DNS over TLS (DoT), DNS over HTTPS (DoH), and lately DNS over QUIC (DoQ).

Continue reading What’s Normal: New uses of DNS, Discovery of Designated Resolvers (DDR), (Tue, Nov 7th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, November 7th, 2023 https://isc.sans.edu/podcastdetail/8734, (Tue, Nov 7th)→

Last week, Atlassian published an advisory for CVE-2023-22518. The vulnerability is a trivial to exploit authentication bypass vulnerability [;1];. Atlassian emphasized the importance of the advisory with a quote from its CISO: “There are no reports of active exploitation at this time; customers must take immediate action to protect their instances.” On Friday, Atlassian confirmed that attackers are actively exploiting the vulnerability.

Continue reading Exploit Activity for CVE-2023-22518, Atlassian Confluence Data Center and Server, (Mon, Nov 6th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, November 6th, 2023 https://isc.sans.edu/podcastdetail/8732, (Mon, Nov 6th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, November 3rd, 2023 https://isc.sans.edu/podcastdetail/8730, (Fri, Nov 3rd)→

In his diary entry “Size Matters for Many Security Controls“, Xavier talks about a PE file that has been artificially inflated in size (to 1GB) by appending NUL bytes (0x00) to its end.

Continue reading Quick Tip For Artificially Inflated PE Files, (Thu, Nov 2nd)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, November 2nd, 2023 https://isc.sans.edu/podcastdetail/8728, (Thu, Nov 2nd)→

Did you ever seen ZPAQ archives? This morning, my honeypot captured a phishing attempt which lured the potential victim to open a “ZPAQ” archive. This is not a common file format. This could be used by the attacker to bypass classic security controles. What Wikiepadia says about ZPAQ:

Continue reading Malware Dropped Through a ZPAQ Archive, (Wed, Nov 1st)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, November 1st, 2023 https://isc.sans.edu/podcastdetail/8726, (Wed, Nov 1st)→

It has been a while that I did not find an interesting malicious Python script. All the scripts that I recently spotted were always the same:&#;x26;#;xc2;&#;x26;#;xa0;a classic intostealer using Discord as C2 channel. Today I found one that contains a lot of anti-sanboxing techniques. Let&#;x26;#;39;s review them. For malware, it&#;x26;#;39;s key to detect the environment where they are executed. When detonated inside a sandbox (automatically or, manually, by an Analyst), they will be able to change their behaviour (most likely, do nothing)

Continue reading Multiple Layers of Anti-Sandboxing Techniques, (Tue, Oct 31st)→