Collaborate Disseminate
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, March 29th, 2023 https://isc.sans.edu/podcastdetail.html?id=8430, (Wed, Mar 29th)
A previous diary [1] described processing some local PCAP data with Zeek. This data was collected using tcpdump on a DShield Honeypot. When looking at the Zeek connection logs, the connection state information was unexpected. To help understand why, we will compare data from different locations on the network and process the data in a similar way. This will help narrow down where the discrepancies might be coming from, or at least where they are not coming from. Some initial factors considered:
Continue reading Network Data Collector Placement Makes a Difference, (Tue, Mar 28th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, March 28th, 2023 https://isc.sans.edu/podcastdetail.html?id=8428, (Tue, Mar 28th)
Apple today released updates for all of its operating systems. The updates also apply for some of the older versions of iOS and macOS. For iOS/iPadOS 15, Apple now patched an already exploited vulnerability (CVE-2023-23529). Current operating systems received a patch for this vulnerability mid January.
Continue reading Apple Updates Everything (including Studio Display), (Mon, Mar 27th)
In this series of diary entries, I will analyze an HTA file I found on MalwareBazaar.
Continue reading Another Malicious HTA File Analysis – Part 1, (Mon, Mar 27th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, March 27th, 2023 https://isc.sans.edu/podcastdetail.html?id=8426, (Mon, Mar 27th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, March 27th, 2023 https://isc.sans.edu/podcastdetail.html?id=8426, (Mon, Mar 27th)
I discovered that the textwrap.wrap function I used in diary entry “String Obfuscation: Character Pair Reversal” does not always group characters as I expected. That&#;x26;#;39;s why I released an update of my python-per-line.py tool, including a Reverse function. And also some simple brute-forcing …
Continue reading Extra: “String Obfuscation: Character Pair Reversal”, (Sun, Mar 26th)
There&#;x26;#;39;s a new major release of CyberChef: version 10.
Continue reading CyberChef Version 10 Released, (Sun, Mar 26th)
To exploit this vulnerability, the image must be created under very specific condition listed here.