Collaborate Disseminate
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, September 2nd, 2022 https://isc.sans.edu/podcastdetail.html?id=8158, (Fri, Sep 2nd)
On Tuesday, the Apache project released an update for Geode. The update patches a typical deserialization issue we often see in Java software like Geode (&#;x26;#;x25;&#;x26;#;x25;cve:2022-37021&#;x26;#;x25;&#;x26;#;x25;). Geode is a data management platform. It has to deal with a wide range of objects and formats. The simple allow listing approach usually doesn&#;x26;#;39;t work well in these environments.
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, September 1st, 2022 https://isc.sans.edu/podcastdetail.html?id=8156, (Thu, Sep 1st)
The use of underscores in DNS records can easily trigger DNS purists into a rage. Since the beginning of (DNS) time, only the letters a-z, numbers, and dashes are allowed in DNS labels (RFC 1035 section 2.3.1). After all, we want to remain compatible with ARPANET.
Continue reading Underscores and DNS: The Privacy Story, (Wed, Aug 31st)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, August 31st, 2022 https://isc.sans.edu/podcastdetail.html?id=8154, (Wed, Aug 31st)
Last week, Brock Perry,&#;x26;#;xc2;&#;x26;#;xa0;one of our SANS.edu undergraduate students, came across a neat bash script uploaded to the honeypot as part of an attack. I am sure this isn&#;x26;#;39;t new, but I never quite saw something like this before myself.
Continue reading Two things that will never die: bash scripts and IRC!, (Tue, Aug 30th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, August 30th, 2022 https://isc.sans.edu/podcastdetail.html?id=8152, (Tue, Aug 30th)
In diary entry “VBA Maldoc & UTF7 (APT-C-35)“, I analyze a malicious document with VBA code that injects shellcode into the host process. That shellcode is UTF7 encoded.
Continue reading Update: VBA Maldoc & UTF7 (APT-C-35), (Mon, Aug 29th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, August 29th, 2022 https://isc.sans.edu/podcastdetail.html?id=8150, (Mon, Aug 29th)
I updated my Cobalt Strike beacon analysis tool 1768.py to deal with false positives in Windows system&#;x26;#;39;s memory dumps.