Collaborate Disseminate
Both Sysinternals utilities (Sysmon and ZoomIt) received updates that significantly extends their scope: Sysmon can now also block actions, and ZoomIt can record videos.
Continue reading Sysinternals Updates: Sysmon v14.0 and ZoomIt v6.01, (Sun, Aug 28th)
I have been getting these queries in my honeypot logs since end of December 2021 and decided to a diary on some of these packets using some basic analysis with Wireshark. Handlers have published a few diaries over the years [1][2][3] regarding this protocol. These packets are from censys.io[4] which is a site that provides internet discovery and inventory like Shodan. In my logs, the activity looked like this:
Continue reading HTTP/2 Packet Analysis with Wireshark, (Fri, Aug 26th)
There is a current wave of Paypal phishing emails ongoing. I already received a few of them. This time, the spam is based on a simple JPEG image. The subject has always this format (with the date changing):
Continue reading Paypal Phishing/Coinbase in One Image, (Fri, Aug 26th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, August 26th, 2022 https://isc.sans.edu/podcastdetail.html?id=8148, (Fri, Aug 26th)
Ever get a “shortened” url (bit.ly, tinyurl.com or whatever) and stress about “clicking that link”? Or worse yet, have that “Oh No” moment after you just clicked it? Or possibly tripped over such a link during IR and have to investigate it? Is there a way to look at the link contents without a sandbox with a packet sniffer (or fiddler or burp or similar)?
Continue reading Taking Apart URL Shorteners, (Thu, Aug 25th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, August 25th, 2022 https://isc.sans.edu/podcastdetail.html?id=8146, (Thu, Aug 25th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, August 24th, 2022 https://isc.sans.edu/podcastdetail.html?id=8144, (Wed, Aug 24th)
In April 2022, the RFC related to the small file &#;x26;#;xe2;&#;x26;#;x80;&#;x26;#;x9c;security.txt&#;x26;#;xe2;&#;x26;#;x80;&#;x26;#;x9d; was released&#;x26;#;x5b;1&#;x26;#;x5d;. It was already popular for a while, but an RFC is always a good way to &#;x26;#;xe2;&#;x26;#;x80;&#;x26;#;x9c;promote&#;x26;#;xe2;&#;x26;#;x80;&#;x26;#;x9d; some best practices&#;x26;#;x21; If you&#;x26;#;39;re unaware of this file, it helps to communicate security contacts (email addresses, phone, …) to people who would like to contact you to report an issue with your website or your organization. This security.txt file was deployed on my websites for a while, and I never really paid attention to its popularity. The ISC also has its one&#;x26;#;x5b;2&#;x26;#;x5d;.
Continue reading Who’s Looking at Your security.txt File?, (Tue, Aug 23rd)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, August 23rd, 2022 https://isc.sans.edu/podcastdetail.html?id=8142, (Tue, Aug 23rd)