Author Archives: SANS Internet Storm Center, InfoCON: green

Leaked credentials are a common thread for a while. Popular services like “Have I Been Pwned”[1] help everyone know if some emails and passwords have been leaked. This is a classic problem: One day, you create an account on a website (ex: an online shop), and later, this website is compromised. All credentials are collected and shared by the attacker. To reduce this risk, a best practice is to avoid password re-use (as well as to not use your corporate email address for non-business-related stuff).

Continue reading Are Leaked Credentials Dumps Used by Attackers?, (Fri, Aug 4th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, August 4th, 2023 https://isc.sans.edu/podcastdetail/8602, (Fri, Aug 4th)→

Last week, my spam trap caught an e-mail with LNK attachment, which turned out to be quite interesting.

Continue reading From small LNK to large malicious BAT file with zero VT score, (Thu, Aug 3rd)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, August 3rd, 2023 https://isc.sans.edu/podcastdetail/8600, (Thu, Aug 3rd)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, August 2nd, 2023 https://isc.sans.edu/podcastdetail/8598, (Wed, Aug 2nd)→

Continue reading Zeek and Defender Endpoint, (Wed, Aug 2nd)→

Our honeypots see a lot of DNS over HTTP(s) requests against the “/dns-query” endpoint. This endpoint is used by DNS over HTTPs requests to receive queries. Queries can use different encodings. You may either see the more readable URL encoding, like “?name=google.com&type=A” or the raw DNS data encoding, like “?dns=mNwBAAABAAAAAAAABmdvb2dsZQNjb20AAAEAAQ”.

Continue reading Summary of DNS over HTTPS requests against our honeypots., (Tue, Aug 1st)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, August 1st, 2023 https://isc.sans.edu/podcastdetail/8596, (Tue, Aug 1st)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, July 31st, 2023 https://isc.sans.edu/podcastdetail/8594, (Mon, Jul 31st)→

Phishing scams have frequently arrived as an SMS message (sometimes called “Smishing”). SMS messages are easy and cheap to send, and we have documented how attackers like to scan for exposed credentials for services like Twilio to make it even cheaper.

Continue reading USPS Phishing Scam Targeting iOS Users, (Sun, Jul 30th)→