Author Archives: SANS Internet Storm Center, InfoCON: green

NTLM relaying has been a plague in Windows environments for many years – and we have witnessed many exploits that rely on the fact that it is possible to relay NTLM authentication attempts to various target services.

Continue reading Importance of signing in Windows environments, (Fri, Jan 20th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, January 20th, 2023 https://isc.sans.edu/podcastdetail.html?id=8334, (Fri, Jan 20th)→

Not too long ago, I wrote a diary discussing SPF and DMARC use on GOV subdomains in different ccTLDs around the world[1]. The results weren’t too optimistic – it turned out that only about 42% of gov.cctld domains had a valid SPF record published and only about 19% of such domains had a valid DMARC record published.

Continue reading SPF and DMARC use on 100k most popular domains, (Thu, Jan 19th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, January 19th, 2023 https://isc.sans.edu/podcastdetail.html?id=8332, (Thu, Jan 19th)→

Introduction

Continue reading Malicious Google Ad –> Fake Notepad++ Page –> Aurora Stealer malware, (Wed, Jan 18th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, January 18th, 2023 https://isc.sans.edu/podcastdetail.html?id=8330, (Wed, Jan 18th)→

—
Johannes B. Ullrich, Ph.D. , Dean of Research, SANS.edu
Twitter|

Continue reading Packet Tuesday: IPv6 Router Advertisements https://www.youtube.com/watch?v=uRWpB_lYIZ8, (Tue, Jan 17th)→

I had a call recently from a client, they were looking for which Group Policy in their AD had a specific setting in it.

Continue reading Finding that one GPO Setting in a Pool of Hundreds of GPOs, (Tue, Jan 17th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, January 17th, 2023 https://isc.sans.edu/podcastdetail.html?id=8328, (Tue, Jan 17th)→

Today, I just have a short public service announcement: You MUST run an adblocker while using Google. It may be best just to keep the adblocker enabled all the time.

Continue reading PSA: Why you must run an ad blocker when using Google, (Mon, Jan 16th)→