Collaborate Disseminate
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, September 26th, 2022 https://isc.sans.edu/podcastdetail.html?id=8188, (Mon, Sep 26th)
Sometimes I want to download a sample from a malicious server, but the domain name no longer resolves (it has been taken down).
Continue reading Downloading Samples From Takendown Domains, (Sun, Sep 25th)
When you lookup a malicious document sample on MalwareBazaar, like this sample, you can see analysis data from olevba and oledump.
Continue reading Maldoc Analysis Info On MalwareBazaar, (Sat, Sep 24th)
Recently, a vulnerability has been disclosed by Vectra that affects Microsoft Teams[;1];, the very popular communication tool used daily by millions of people (me too). Security researchers found that Teams storesÂ; ;session tokens in clear text on the file system. I wonâ;;;t discuss the vulnerability here; read the blog post if you want to learn more. The critical element is that once the token has been stolen, an attacker can impersonate the user.
Continue reading Kids Like Cookies, Malware Too!, (Fri, Sep 23rd)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, September 23rd, 2022 https://isc.sans.edu/podcastdetail.html?id=8186, (Fri, Sep 23rd)
I found a simple batch file that drops a Remcos[1] RAT through an old UAC Bypass technique. This technique is based on the “fodhelper” utility (“Features On Demand Helper”). Once launched, this tool will search for specific registry keys and, if present, will execute their content with high privileges.
Continue reading RAT Delivered Through FODHelper , (Thu, Sep 22nd)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, September 22nd, 2022 https://isc.sans.edu/podcastdetail.html?id=8184, (Thu, Sep 22nd)
A phishing campaign needs some resources: bandwidth, CPU, storage, ⦠For a very long time, a lot of phishing kits have been hosted on compromised servers. The most popular are CMS with weak configurations or outdated. I think that Wordpress is the number one in this category. By careful, it does not mean that Wordpress is a bad CMS. Most vulnerabilities are introduced through plugins. Once compromised, the phishing kit files are copied on the server and usually are reachable via the /wp-content/ or /wp-plugin/ directories.
Continue reading Phishing Campaigns Use Free Online Resources, (Wed, Sep 21st)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, September 21st, 2022 https://isc.sans.edu/podcastdetail.html?id=8182, (Wed, Sep 21st)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, September 20th, 2022 https://isc.sans.edu/podcastdetail.html?id=8180, (Tue, Sep 20th)