Collaborate Disseminate
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, July 12th, 2022 https://isc.sans.edu/podcastdetail.html?id=8082, (Tue, Jul 12th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, July 11th, 2022 https://isc.sans.edu/podcastdetail.html?id=8080, (Mon, Jul 11th)
This past week I got this attachment and this time I used CyberChef [3] using the same technique published by Didier [1] last year to do a quick analysis of the file vs using oledump. I checked the SHA256 in virustotal and it showed this file had been submitted for analysis and was identified as Emotet [2].
Continue reading Excel 4 Emotet Maldoc Analysis using CyberChef, (Sun, Jul 10th)
While doing tests for my diary entries “7-Zip & MoW” and “7-Zip & MoW: “For Office files”“, I observed that the MoW is removed when you edit a ZIP file with 7-Zip.
Our website needed a facelift. And today, we got it just in time for SANSFIRE ;-).
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, July 7th, 2022 https://isc.sans.edu/podcastdetail.html?id=8078, (Thu, Jul 7th)
x509 certificates, as they are used for TLS, can include multiple “Subject Alternative Names” (SANs) to be used with various websites. Experimenting with numerous ways to detect TLS anomalies, I looked at my Zeek x509 logs to summarize how many names are present in certificates.
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, July 6th, 2022 https://isc.sans.edu/podcastdetail.html?id=8076, (Wed, Jul 6th)
We are about two months past the 5-year anniversary of WannaCry outbreak[1] and about a week past the 5-year anniversary of NotPetya outbreak[2]. Since both WannaCry and NotPetya used the EternalBlue[3] exploit in order to spread, I thought that it might be interesting to take a look at how many internet-facing systems still remain vulnerable to it.
Continue reading EternalBlue 5 years after WannaCry and NotPetya, (Tue, Jul 5th)