Author Archives: SANS Internet Storm Center, InfoCON: green

A short while ago, I floated the idea of a weekly video series with short lessons about packets, protocols, and networks. Today, we are kicking of “Packet Tuesday”. Packet Tuesday, as the name implies, will release a new video each Tuesday. We will discuss packets in detail. See the first two videos below. For future videos, please subscribe to the YouTube channel. I will also use PacketTuesday.com for videos and related materials. There is usually a PCAP file to go with each video.

Continue reading Packet Tuesday: Network Traffic Analysis for the Whole Family, (Tue, Nov 15th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, November 15th, 2022 https://isc.sans.edu/podcastdetail.html?id=8258, (Tue, Nov 15th)→

Seeing abnormal Suricata alerts isn’t too unusual in my home environment. In many cases it may be a TLD being resolved that at one point in time was very suspicious. With the increased legitimate adoption of some of these domains, these alerts have been less useful, although still interesting to investigate. I ran into a few of these alerts one night and when diving deeper there was an unusual amount, frequency, and source of the alerts.

Continue reading Extracting ‘HTTP CONNECT’ Requests with Python, (Mon, Nov 14th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, November 14th, 2022 https://isc.sans.edu/podcastdetail.html?id=8256, (Mon, Nov 14th)→

I recorded a video for this diary entry.

Continue reading Extracting Information From “logfmt” Files With CyberChef, (Sat, Nov 12th)→

I got feed back via Twitter on my diary entry “IPv4 Address Representations“: CyberChef&#;x26;#;39;s operation Change IP Format does transform IPv4 representations.

Continue reading Update: IPv4 Address Representations, (Fri, Nov 11th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, November 11th, 2022 https://isc.sans.edu/podcastdetail.html?id=8254, (Fri, Nov 11th)→

Indicators of Compromise, or IOCs,&#;x26;#;xc2;&#;x26;#;xa0;are key elements in blue team activities. IOCs are mainly small pieces of technical information that have been collected during investigations, threat hunting activities&#;x26;#;xc2;&#;x26;#;xa0;or malware analysis. About the last example, the&#;x26;#;xc2;&#;x26;#;xa0;malware analyst&#;x26;#;39;s goal is&#;x26;#;xc2;&#;x26;#;xa0;identify how the malware is behaving and how to indentify it.

Continue reading Do you collect “Observables” or “IOCs”?, (Thu, Nov 10th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, November 10th, 2022 https://isc.sans.edu/podcastdetail.html?id=8252, (Thu, Nov 10th)→

In the past, I already found some script-based ransomware samples written in Python or Powershell[1]. The last one I found was only a “proof-of-concept” (my guess) but it demonstrates how easy such malware can be developed and how they remain undetected by most antivirus products.

Continue reading Another Script-Based Ransomware, (Wed, Nov 9th)→