Collaborate Disseminate
In the first Patch Tuesday of 2023, we got patches for 98 vulnerabilities. Of these, 11 are critical, 1 was previously disclosed, and 1 is already being exploited, according to Microsoft.
Continue reading Microsoft January 2023 Patch Tuesday, (Tue, Jan 10th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, January 10th, 2023 https://isc.sans.edu/podcastdetail.html?id=8318, (Tue, Jan 10th)
I have written before about attackers looking for exposed configuration files. Configuration files often include credentials or other sensitive information.Today, I noticed some scans for a files called “/.circleci/config.yml”. Given the recent breach at CircleCI, I dug in a bit deeper.
Continue reading New year, old tricks: Hunting for CircleCI configuration files, (Mon, Jan 9th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, January 9th, 2023 https://isc.sans.edu/podcastdetail.html?id=8316, (Mon, Jan 9th)
This is a review and analysis of some of my json DShield logs for a 9-day period. For this, I created some parsers using jq [1] and MS PowerBI which I described here to parse GeoIP [2] with the script previously posted here. This is the highlights from this timeframe 5 – 13 Dec 2022:
Continue reading DShield Sensor JSON Log Analysis, (Sun, Jan 8th)
YARA release candidate 1 for version 4.3.0 brings a Windows fix for the –skip-larger option.
Continue reading YARA v4.3.0-rc1 –skip-larger, (Sat, Jan 7th)
Yesterday Brad wrote an interesting diary[1] about a piece o malware based on AutoIT. Funny, I was also analyzing a sample that has been written in the same language. I don’t know exactly the source (it was spotted via a hunting ruile) but it seems to target the same people (based on the file name). Mine was delivered in a RAR archive called âdoc-Impostos_514281.rarâ (SHA256:84a35910ad7acb1455695be7aced111356fac9abc818f9ae0859677b07ac0d04). The VT score is very low: 1/61[2].
Continue reading AutoIT Remains Popular in the Malware Landscape, (Fri, Jan 6th)
Yesterday Brad wrote an interesting diary[1] about a piece o malware based on AutoIT. Funny, I was also analyzing a sample that has been written in the same language. I don’t know exactly the source (it was spotted via a hunting ruile) but it seems to target the same people (based on the file name). Mine was delivered in a RAR archive called âdoc-Impostos_514281.rarâ (SHA256:84a35910ad7acb1455695be7aced111356fac9abc818f9ae0859677b07ac0d04). The VT score is very low: 1/61[2].
Continue reading AutoIT Remains Popular in the Malware Landscape, (Fri, Jan 6th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, January 6th, 2023 https://isc.sans.edu/podcastdetail.html?id=8314, (Fri, Jan 6th)