Collaborate Disseminate
PowerShell remains an excellent way to compromise computers. Many PowerShell scripts found in the wild are usually obfuscated. Most of the time, this helps to have the script detected by fewer antivirus vendors. Yesterday, I found a script that scored 0/59 on VT! Let’s have a look at it.
Continue reading Undetected PowerShell Backdoor Disguised as a Profile File, (Fri, Jun 9th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, June 9th, 2023 https://isc.sans.edu/podcastdetail/8532, (Fri, Jun 9th)
Looking at today&#;x26;#;39;s weblogs from our honeypot, I noticed one IP in particular, %%ip:83.97.73.89%%, scanning for “/geoserver” related URLs. This isn&#;x26;#;39;t new, and we have seen researchers, in particular Shadowserver, looking for similar URLs at least since the beginning of the year.
Continue reading Ongoing scans for Geoserver, (Thu, Jun 8th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, June 8th, 2023 https://isc.sans.edu/podcastdetail/8530, (Thu, Jun 8th)
In my previous DMARC diary, I was discussing how DMARC control is handled on all CO domains from April 2023 and provided the detail about this control for com.co domains.
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, June 7th, 2023 https://isc.sans.edu/podcastdetail/8528, (Wed, Jun 7th)
I played with GitHub Copilot and compared it to simple “Googleing” code snippets to see what is more secure. Please see the video below for a quick recording of the experiment.
Continue reading Github Copilot vs. Google: Which code is more secure, (Tue, Jun 6th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, June 6th, 2023 https://isc.sans.edu/podcastdetail/8526, (Tue, Jun 6th)
[Guest dairy submitted by Gebhard]
Continue reading Brute Forcing Simple Archive Passwords, (Mon, Jun 5th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, June 5th, 2023 https://isc.sans.edu/podcastdetail/8524, (Mon, Jun 5th)