Author Archives: SANS Internet Storm Center, InfoCON: green

We regularly write about MSI files, as it is one of the many fileformats used by attackers. For example, here is a diary entry from Xavier in 2018: “Malware Delivered via Windows Installer Files“.

Continue reading oledump & MSI Files, (Sun, Feb 26th)→

I&#;x26;#;39;ve known the CrypTool website for many years, I use it occasioanly when I need to do some crypto and I only have a browser at my disposal. Lately, I&#;x26;#;39;m more inclined to use CyberChef, as it provides also many non-crypto features.

Continue reading Crypto Inside a Browser, (Sat, Feb 25th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, February 24th, 2023 https://isc.sans.edu/podcastdetail.html?id=8384, (Fri, Feb 24th)→

Introduction

Continue reading URL files and WebDAV used for IcedID (Bokbot) infection, (Fri, Feb 24th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, February 23rd, 2023 https://isc.sans.edu/podcastdetail.html?id=8382, (Thu, Feb 23rd)→

Looking over some of our honeypot logs today, I noticed one IP address, %;%;ip:60.223.74.99%;%;, scanning for several older Confluence vulnerabilities.Â; ;

Continue reading Internet Wide Scan Fingerprinting Confluence Servers, (Wed, Feb 22nd)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, February 22nd, 2023 https://isc.sans.edu/podcastdetail.html?id=8380, (Wed, Feb 22nd)→

Here is another perfect example that shows how attackers abuse free services…

Continue reading Phishing Page Branded with Your Corporate Website, (Tue, Feb 21st)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, February 21st, 2023 https://isc.sans.edu/podcastdetail.html?id=8378, (Tue, Feb 21st)→

I end my diary entry “Detecting (Malicious) OneNote Files” with a set of Suricata rules to detect various OneNote files.

Continue reading OneNote Suricata Rules, (Sun, Feb 19th)→