Collaborate Disseminate
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, May 11th, 2023 https://isc.sans.edu/podcastdetail/8492, (Thu, May 11th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, May 10th, 2023 https://isc.sans.edu/podcastdetail.html?id=8490, (Wed, May 10th)
This month we got patches for 49 vulnerabilities. Of these, 6 are critical, and 2 are already being exploited, according to Microsoft.
Continue reading Microsoft May 2023 Patch Tuesday, (Tue, May 9th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, May 9th, 2023 https://isc.sans.edu/podcastdetail.html?id=8488, (Tue, May 9th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, May 8th, 2023 https://isc.sans.edu/podcastdetail.html?id=8486, (Mon, May 8th)
Malicious documents like this RevengeRAT ppam file found on MalwareBazaar contain VBA code that you can analyze with oledump.py.
Continue reading Quickly Finding Encoded Payloads in Office Documents, (Sun, May 7th)
While analyzing a Guildma (AKA Astaroth) sample recently uploaded to MalwareBazaar [1], we came across a chain of LOLBIN abuse. It is not uncommon to see malicious code using the LOLBIN âbitsadmin.exe’ to download artifacts from the Internet. However, what is interesting in this case is that Guildma first copies âbitsadmin.exe’ to a less suspect path using âcolorcpl.exe‘, another LOLBIN, before executing it.
Continue reading Guildma is now abusing colorcpl.exe LOLBIN, (Fri, May 5th)