Author Archives: SANS Internet Storm Center, InfoCON: green

Recently, I was involved in a network outage caused by a defective pfSense firewall appliance. Due to&#;x26;#;xc2;&#;x26;#;xa0;storage issues (with the onboard flash), the firewall did not boot anymore. This can be quickly solved from a hardware point of view because this firewall model has a slot to install an M2-compatible flash device and boot from it. But, there was a problem with the configuration. The last backup they had was pretty old, and they made a lot of changes. No debate about the fact that a robust backup process should have been implemented. Let&#;x26;#;39;s focus on the challenge of recovering the last configuration from the firewall. Challenge accepted!

Continue reading Using DFIR Techniques To Recover From Infrastructure Outages, (Fri, May 26th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, May 26th, 2023 https://isc.sans.edu/podcastdetail/8514, (Fri, May 26th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, May 26th, 2023 https://isc.sans.edu/podcastdetail/8514, (Fri, May 26th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, May 26th, 2023 https://isc.sans.edu/podcastdetail/8514, (Fri, May 26th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, May 25th, 2023 https://isc.sans.edu/podcastdetail/8512, (Thu, May 25th)→

Continue reading IR Case/Alert Management, (Wed, May 24th)→

While reviewing cowrie &#;x26;#;x5b;1&#;x26;#;x5d; logs from my honeypot &#;x26;#;x5b;2&#;x26;#;x5d; and developing my cowrieprocessor python script &#;x26;#;x5b;3&#;x26;#;x5d;, I&#;x26;#;39;ve been interested in adding information to understand more about some of the attack sources.

Continue reading More Data Enrichment for Cowrie Logs, (Wed, May 24th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, May 24th, 2023 https://isc.sans.edu/podcastdetail/8510, (Wed, May 24th)→

Please let me know if you have any idea what they are trying to do here 🙂

Continue reading Help us figure this out: Scans for Apache “Nifi”, (Tue, May 23rd)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, May 23rd, 2023 https://isc.sans.edu/podcastdetail/8508, (Tue, May 23rd)→