Author Archives: SANS Internet Storm Center, InfoCON: green

Attackers are always trying to find new ways to deliver malware to victims. They recently started sending Microsoft OneNote files in massive phishing campaigns[1]. OneNote files (ending the extension “.one”) are handled automatically by computers that have the Microsoft Office suite installed. Yesterday, my honeypot caught a first sample. This is a good opportunity to have a look at these files. The file, called “delivery-note.one”, was delivered as an attachment to a classic phishing email:

Continue reading A First Malicious OneNote Document, (Wed, Jan 25th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, January 25th, 2023 https://isc.sans.edu/podcastdetail.html?id=8340, (Wed, Jan 25th)→

—
Johannes B. Ullrich, Ph.D. , Dean of Research, SANS.edu
Twitter|

Continue reading And yet another packet Tuesday. Sticking with IPv6 for this episode: Neighbor Discovery! https://www.youtube.com/watch?v=CoaZjuuY1do #ipv6 #packetlife #pcaps #inpcapswetrust #packettuesday, (Tue, Jan 24th)→

Apple yesterday released its usually set of updates across its entire portfolio of operating systems. Some issues of note:

Continue reading Apple Updates (almost) Everything: Patch Overview, (Tue, Jan 24th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, January 24th, 2023 https://isc.sans.edu/podcastdetail.html?id=8338, (Tue, Jan 24th)→

Challenge of the day: To find the process that resolved a specific domain. And this is not always easy!

Continue reading Who’s Resolving This Domain?, (Mon, Jan 23rd)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, January 23rd, 2023 https://isc.sans.edu/podcastdetail.html?id=8336, (Mon, Jan 23rd)→

This new release of Wireshark brings 22 bug fixes (including 7 vulnerabilities).

Continue reading Wireshark 4.0.3 Released, (Sun, Jan 22nd)→

My current project has been to rebuild my home DShield sensor from a Rasberry Pi to a Ubuntu 20.04.5 LTS server to be able to process my sensor logs into Elasticsearh. I use as a guide the example listed here (my ELK is version 8.x) sending the cowrie.json logs to a remote ELK server (version 8.4.1) using Filebeat and Logstash. However, my steps were a little different than the reference:

Continue reading DShield Sensor JSON Log to Elasticsearch, (Sat, Jan 21st)→

NTLM relaying has been a plague in Windows environments for many years – and we have witnessed many exploits that rely on the fact that it is possible to relay NTLM authentication attempts to various target services.

Continue reading Importance of signing in Windows environments, (Fri, Jan 20th)→