Collaborate Disseminate
This month we got patches for 114 vulnerabilities. Of these, 7 are critical, and 1 is already being exploited, according to Microsoft.
Continue reading Microsoft April 2023 Patch Tuesday, (Tue, Apr 11th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, April 11th, 2023 https://isc.sans.edu/podcastdetail.html?id=8448, (Tue, Apr 11th)
The first part in this series can be found here. In the first part, we ended with a decoded PowerShell script. We will now start to decrypt the payload found inside this PowerShell script:
Continue reading Another Malicious HTA File Analysis – Part 2, (Mon, Apr 10th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, April 10th, 2023 https://isc.sans.edu/podcastdetail.html?id=8446, (Mon, Apr 10th)
When Johannes mentioned on the Stormcast that 3CX&#;x26;#;39;s trojanized installer was blocked by Google Chrome, I remembed a feature I don&#;x26;#;39;t often use.
Continue reading Chrome’s Download Tab: Dangerous Files, (Sun, Apr 9th)
This has been brought to our attention by a reader (thank you, William!). The vulnerability %%cve:2022-38038%% affected the Microsoft Netlogon[1] procedure with an RPC escalation of privilege vulnerability. Microsoft provided a patch to fix it. It improves the Netlogon security by enforcing RPC sealing instead of signing off the communication with the Domain Controller. RPC sealing is a security measure that both signs and encrypts the messages sent over the wire by the Netlogon protocol. Microsoft released a knowledge base article[2] with more information about the technique used to fix the vulnerability.
Continue reading Microsoft Netlogon: Potential Upcoming Impacts of CVE-2022-38023, (Sat, Apr 8th)
Apple today released updates for iOS and macOS (as well as Safari). The update fixes two vulnerabilities that are already being exploited:
Continue reading Apple Patching Two 0-Day Vulnerabilities in iOS and macOS, (Fri, Apr 7th)
YARA[1] is a beautiful tool for malware researchers and incident responders. No need to present it again. It became a standard tool to add to your arsenal. While teaching FOR610 (Malware Analysis & Reverse Engineering), a student asked me how to detect specific API calls with dangerous parameters during the triage phase. This phase will help you quickly assess the malware sample and help you decide how to perform the following steps.
Continue reading Detecting Suspicious API Usage with YARA Rules, (Fri, Apr 7th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, April 7th, 2023 https://isc.sans.edu/podcastdetail.html?id=8444, (Fri, Apr 7th)
Web applications are a wide world that is currently the object of numerous cyberattacks, mostly seeking to compromise the information directly in the clients that use them.