Collaborate Disseminate
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, January 2nd, 2023 https://isc.sans.edu/podcastdetail.html?id=8306, (Mon, Jan 2nd)
YARA release candidate 1 for version 4.3.0 brings a new option for XOR strings: –print-xor-key
Continue reading YARA v4.3.0-rc1 –print-xor-key, (Sat, Dec 31st)
Although e-mail is one of the cornerstones of modern interpersonal communication, its underlying Simple Mail Transfer Protocol (SMTP) is far from what we might call ârobustâ or âsecureâ[1]. By itself, the protocol lacks any security features related to ensuring (among other factors) integrity or authenticity of transferred data or the identity of their sender, and creating a âspoofedâ e-mail is therefore quite easy. This poses a significant issue, especially when one considers that most ordinary people don’t tend to question the validity of officially looking messages if it appears that they were sent from a respectable/well-known domain.
Continue reading SPF and DMARC use on GOV domains in different ccTLDs, (Fri, Dec 30th)
There are a variety of services listening for connections on DShield honeypots &#;x26;#;x5b;1&#;x26;#;x5d;. Different systems scanning the internet can connect to these listening services due to exceptions in the firewall. Any attempted connections blocked by the firewall are logged and can be analyzed later. This can be useful to see TCP port connection attempts, but it&#;x26;#;39;s usefulness is limited. Without the ability to complete the SYN, SYN-ACK, ACK handshake process other protocol data may not be sent.
Continue reading Opening the Door for a Knock: Creating a Custom DShield Listener, (Thu, Dec 29th)
In this post we&#;x26;#;39;ll take a look at parsing and manipulating JSON in Powershell.
Continue reading Playing with Powershell and JSON (and Amazon and Firewalls), (Wed, Dec 28th)
In November I setup the DShield sensor in my Azure tenant using Ubuntu version 20.04. Here are the steps I followed. First select and build the Ubuntu VM, I used the default disk size and 512 MB RAM:
Continue reading DShield Sensor Setup in Azure, (Wed, Dec 21st)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, December 23rd, 2022 https://isc.sans.edu/podcastdetail.html?id=8304, (Fri, Dec 23rd)
According to a post by Rapid7, they have observed Exchange server 2013, 2016 & 2019 being actively exploited for “a chaining of CVE-2022-41080 and CVE-2022-41082 to bypass URL rewrite mitigations that Microsoft provided for ProxyNotShell allowing for remote code execution (RCE) via privilege escalation via Outlook Web Access (OWA).”[1]
Continue reading Exchange OWASSRF Exploited for Remote Code Execution, (Thu, Dec 22nd)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, December 22nd, 2022 https://isc.sans.edu/podcastdetail.html?id=8302, (Thu, Dec 22nd)