Collaborate Disseminate
Keeping accurate time has never been easier. In the early days of my computing experience, the accuracy of computer clocks was always questionable. Many of them kept worse time than a &#;x26;#;x24;5 wristwatch. Having a cheap quartz oscillator on a motherboard with widely varying temperatures just didn&#;x26;#;39;t work all that well.
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, December 21st, 2022 https://isc.sans.edu/podcastdetail.html?id=8300, (Wed, Dec 21st)
There can be multiple reasons to keep an eye on a critical/suspicious file or directory. For example, you could track an attacker and wait for some access to the captured credentials in a phishing kit installed on a compromised server. You could deploy an EDR solution or an OSSEC agent that implements an FIM (âFile Integrity Monitoringâ)[1]. Upon a file change, an action can be triggered. Nice, but what if you would like a quick solution but agentless? (In the scope of an incident, for example)
Continue reading Linux File System Monitoring & Actions, (Tue, Dec 20th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, December 20th, 2022 https://isc.sans.edu/podcastdetail.html?id=8298, (Tue, Dec 20th)
Since Elon Mush took control of Twitter, there has been considerable interest in alternative platforms to the micro-blogging network. Without certainty about Twitter&#;x26;#;39;s future, many people switched to the Mastodon[1] network. Most of the ISC Handlers are now present on this decentralized network. For example, I’m reachable via @xme@infosec.exchange[2]. You can find our addresses on the Contact page[3].
Continue reading Hunting for Mastodon Servers, (Mon, Dec 19th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, December 19th, 2022 https://isc.sans.edu/podcastdetail.html?id=8296, (Mon, Dec 19th)
Got this file attachment this week pretending to be from HSBC Global Payments and Cash Management. The attachment payment_copy.pdf.z is a rar archive, kind of unusual with this type of file archive but when extracted, it comes out as a double extension with pdf.exe. The file is a trojan infostealer and detected by multiple scanning engines.
Continue reading Infostealer Malware with Double Extension, (Sun, Dec 18th)
VMware released the following security updates from important to critical: