Author Archives: SANS Internet Storm Center, InfoCON: green

Process injection is a common technique used by malware to cover their tracks. What&#;x26;#;xc2;&#;x26;#;xa0;looks more legit than a process called “notepad.exe” or “explorer.exe”&#;x26;#;x3f; They are multiple ways to perform process injection, one of them is called “Process Hollowing” (T1055/012/)&#;x26;#;x5b;1&#;x26;#;x5d;. When I&#;x26;#;39;m teaching FOR610, students are often surprised that it&#;x26;#;39;s a feature of the operating system, so, by default, not malicious. Microsoft offers all the required API calls to perform this. Some legit applications use many process injection techniques like your best antivirus or EDR solution!

Continue reading Easy Process Injection within Python, (Wed, Sep 14th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, September 14th, 2022 https://isc.sans.edu/podcastdetail.html?id=8172, (Wed, Sep 14th)→

This month we got patches for 79 vulnerabilities. Of these, 5 are critical, 2 were previously disclosed, and 1 is already being exploited, according to Microsoft.

Continue reading Microsoft September 2022 Patch Tuesday, (Tue, Sep 13th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, September 13th, 2022 https://isc.sans.edu/podcastdetail.html?id=8170, (Tue, Sep 13th)→

[This post was submitted by Jesse La Grew]

Continue reading VirusTotal Result Comparisons for Honeypot Malware, (Mon, Sep 12th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, September 12th, 2022 https://isc.sans.edu/podcastdetail.html?id=8168, (Mon, Sep 12th)→

Wireshark version 3.6.8 was released. It fixes 1 vulnerability and 15 bugs.

Continue reading Wireshark 3.6.8 and 4.0.0rc1 Released, (Sun, Sep 11th)→

Got this word document this week that was quarantined as phishing by Defender (223341099.docx) with the Subject: Urgent Payment Issue. Using Didier malware analysis tools, I ran through the following checks to see what could be embedded in it that is likely suspicious. I first checked the file using oledump.py to see if there were any OLE files in this document.

Continue reading Phishing Word Documents with Suspicious URL, (Sat, Sep 10th)→

There is also a video for this analysis: “Maldoc Analysis: Rehearsed vs. Unrehearsed“.

Continue reading Maldoc With Decoy BASE64, (Fri, Sep 9th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, September 9th, 2022 https://isc.sans.edu/podcastdetail.html?id=8166, (Fri, Sep 9th)→