Analyzing Obfuscated VBS with CyberChef, (Thu, Sep 8th)
I took a closer look at this sample on MalwareBazaar, because it had no tags (now it has a VBS tag).
Continue reading Analyzing Obfuscated VBS with CyberChef, (Thu, Sep 8th)
Author Archives: SANS Internet Storm Center, InfoCON: green
ISC Stormcast For Thursday, September 8th, 2022 https://isc.sans.edu/podcastdetail.html?id=8164, (Thu, Sep 8th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, September 8th, 2022 https://isc.sans.edu/podcastdetail.html?id=8164, (Thu, Sep 8th)
PHP Deserialization Exploit attempt, (Wed, Sep 7th)
I came across the following deserialization exploit attempt not in a honeypot but in the log for this (isc.sans.edu) webserver:
Continue reading PHP Deserialization Exploit attempt, (Wed, Sep 7th)
ISC Stormcast For Wednesday, September 7th, 2022 https://isc.sans.edu/podcastdetail.html?id=8162, (Wed, Sep 7th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, September 7th, 2022 https://isc.sans.edu/podcastdetail.html?id=8162, (Wed, Sep 7th)
Analysis of an Encoded Cobalt Strike Beacon, (Tue, Sep 6th)
I also created a video for this diary entry.
Continue reading Analysis of an Encoded Cobalt Strike Beacon, (Tue, Sep 6th)
ISC Stormcast For Tuesday, September 6th, 2022 https://isc.sans.edu/podcastdetail.html?id=8160, (Tue, Sep 6th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, September 6th, 2022 https://isc.sans.edu/podcastdetail.html?id=8160, (Tue, Sep 6th)
Quickie: Grep & Tail -f With Notepad++, (Mon, Sep 5th)
Notepad++ is a free and open source text editor for Windows.
Continue reading Quickie: Grep & Tail -f With Notepad++, (Mon, Sep 5th)
Video: VBA Maldoc & UTF7 (APT-C-35), (Sun, Sep 4th)
I recorded a video for the maldoc analysis I did in diary entries “VBA Maldoc & UTF7 (APT-C-35)” and “Update: VBA Maldoc & UTF7 (APT-C-35)“.
Continue reading Video: VBA Maldoc & UTF7 (APT-C-35), (Sun, Sep 4th)
Video: James Webb JPEG With Malware, (Sat, Sep 3rd)
I recorded a video for yesterday&#;x26;#;39;s diary entry James Webb JPEG With Malware.
Continue reading Video: James Webb JPEG With Malware, (Sat, Sep 3rd)
James Webb JPEG With Malware, (Fri, Sep 2nd)
On Wednesday&#;x26;#;39;s stormcast, Johannes talked about a JPEG picture (coming from the Jales Webb telescope) that malware authors had laced with malware.
Continue reading James Webb JPEG With Malware, (Fri, Sep 2nd)