Author Archives: SANS Internet Storm Center, InfoCON: green
ISC Stormcast For Monday, September 19th, 2022 https://isc.sans.edu/podcastdetail.html?id=8178, (Mon, Sep 19th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, September 19th, 2022 https://isc.sans.edu/podcastdetail.html?id=8178, (Mon, Sep 19th)
Preventing ISO Malware , (Sun, Sep 18th)
In the last few weeks, I’ve seen a significant uptick in systems infected with Chromeloader malware. This malware is a malicious extension for your browser, redirecting it to ad sites and hijacking searches. But with the success of this technique recently, I would not be surprised if others will take notice and switch to using it for other things.
Video: Grep & Tail -f With Notepad++, (Sun, Sep 18th)
This is a video for diary entry “Quickie: Grep & Tail -f With Notepad++“.
Continue reading Video: Grep & Tail -f With Notepad++, (Sun, Sep 18th)
Video: Analyzing Obfuscated VBS with CyberChef, (Sat, Sep 17th)
Here is a video for my diary entry “Analyzing Obfuscated VBS with CyberChef“.
Continue reading Video: Analyzing Obfuscated VBS with CyberChef, (Sat, Sep 17th)
Word Maldoc With CustomXML and Renamed VBAProject.bin, (Fri, Sep 16th)
Friend and colleague 0xThiebaut just gave me a heads up for this interesting sample: 2056b52f8c2f62e222107e6fb6ca82708cdae73a91671d40e61aef8698e3e139
Continue reading Word Maldoc With CustomXML and Renamed VBAProject.bin, (Fri, Sep 16th)
ISC Stormcast For Friday, September 16th, 2022 https://isc.sans.edu/podcastdetail.html?id=8176, (Fri, Sep 16th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, September 16th, 2022 https://isc.sans.edu/podcastdetail.html?id=8176, (Fri, Sep 16th)
Malicious Word Document with a Frameset, (Thu, Sep 15th)
This is definitively new, but I did not see this type of document for a while. I spotted a malicious Word OOXML document (the new “.docx” format) that is a simple downloader. Usually, malicious documents contain an embedded file, a VBA macro, or the recent vulnerability MS-MSDT[1]. This time, the document does not contain any malicious code but just refers to a second stage that will be delivered when the document is opened.
Continue reading Malicious Word Document with a Frameset, (Thu, Sep 15th)
Malicious Word Document with a Frameset, (Thu, Sep 15th)
This is definitively new, but I did not see this type of document for a while. I spotted a malicious Word OOXML document (the new “.docx” format) that is a simple downloader. Usually, malicious documents contain an embedded file, a VBA macro, or the recent vulnerability MS-MSDT[1]. This time, the document does not contain any malicious code but just refers to a second stage that will be delivered when the document is opened.
Continue reading Malicious Word Document with a Frameset, (Thu, Sep 15th)
ISC Stormcast For Thursday, September 15th, 2022 https://isc.sans.edu/podcastdetail.html?id=8174, (Thu, Sep 15th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, September 15th, 2022 https://isc.sans.edu/podcastdetail.html?id=8174, (Thu, Sep 15th)