Collaborate Disseminate
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, June 28th, 2023 https://isc.sans.edu/podcastdetail/8554, (Wed, Jun 28th)
When dealing with malware analysis, you like to get “fresh meat”. Just for hunting purposes or when investigating incidents in your organization, it’s essential to have a triage process to reduce the noise and focus on really interesting files. For example, if you detect a new sample of Agent Tesla, you don’t need to take time to investigate it deeply. Just extract IOCs to share with your colleagues. From a business point of view, you don’t have time to analyze all samples!
Continue reading The Importance of Malware Triage, (Tue, Jun 27th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, June 27th, 2023 https://isc.sans.edu/podcastdetail/8552, (Tue, Jun 27th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, June 26th, 2023 https://isc.sans.edu/podcastdetail/8550, (Mon, Jun 26th)
This week (2023-06-21) I found 2 emails attachment in quarantine that had different text with the same attachment. The first one had an Office 365 indicating the admin had setup a custom rule to block the message and could not be delivered to the recipients and what to do to fix it.
Continue reading Email Spam with Attachment Modiloader, (Sat, Jun 24th)
It has been a while since I spotted such kind of document. Yesterday, I found a Word document (SHA256:5070e8a3fdaf3027170ade066eaf7f8e384c1cd25ce58af9155627975f97d156)[1] behaving like a dropper.
Continue reading Word Document with an Online Attached Template, (Fri, Jun 23rd)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, June 23rd, 2023 https://isc.sans.edu/podcastdetail/8548, (Fri, Jun 23rd)
Apple released iOS, macOS, and watchOS updates, patching three vulnerabilities already being exploited. Two vulnerabilities affect WebKit, leading to a Safari patch for older operating systems.
The two WebKit issues (CVE-2023-32439 and CVE-2023-32435) can be used to execute arbitrary code as a user visits a malicious web page. The third vulnerability, CVE-2023-32434, can be used to elevate privileges after the initial code execution.
See below for affected operating systems. Apple does not provide CVSS scores, so we asked ChatGPT to fill them in.
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, June 22nd, 2023 https://isc.sans.edu/podcastdetail/8546, (Thu, Jun 22nd)