Collaborate Disseminate
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, June 15th, 2022 https://isc.sans.edu/podcastdetail.html?id=8050, (Wed, Jun 15th)
This month we got patches for 60 vulnerabilities. Of these, 3 are critical, none previously disclosed, and none being exploited according to Microsoft.
Continue reading Microsoft June 2022 Patch Tuesday, (Tue, Jun 14th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, June 14th, 2022 https://isc.sans.edu/podcastdetail.html?id=8048, (Tue, Jun 14th)
Saitama is a backdoor that uses the DNS protocol to encapsulate its command and control (C2) messages – a technique known as DNS Tunneling (MITRE ATT&CK T1071). Spotted and documented by MalwareBytes in two articles posted last month (How the Saitama backdoor uses DNS tunneling and APT34 targets Jordan Government using new Saitama backdoor), Saitama was used in a phishing e-mail targeted to a government official from Jordan’s foreign ministry on an attack attributed to the Iranian group APT34.
Continue reading Translating Saitama’s DNS tunneling messages, (Mon, Jun 13th)
Saitama is a backdoor that uses the DNS protocol to encapsulate its command and control (C2) messages – a technique known as DNS Tunneling (MITRE ATT&CK T1071). Spotted and documented by MalwareBytes in two articles posted last month (How the Saitama backdoor uses DNS tunneling and APT34 targets Jordan Government using new Saitama backdoor), Saitama was used in a phishing e-mail targeted to a government official from Jordan’s foreign ministry on an attack attributed to the Iranian group APT34.
Continue reading Translating Saitama’s DNS tunneling messages, (Mon, Jun 13th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, June 13th, 2022 https://isc.sans.edu/podcastdetail.html?id=8046, (Mon, Jun 13th)
It is known that a “Follina exploit” RTF maldoc can lead to code execution by being viewed in Explorer&#;x26;#;39;s preview pane:
Continue reading Quickie: Follina, RTF & Explorer Preview Pane, (Sun, Jun 12th)
If you followÂ; ;Cyentia Instituteâ;;;sÂ; ;Jay JacobsÂ; ;via social media you mayÂ; ;FIRSTÂ; ;;-) have learned about the Exploit Prediction Scoring System (EPSS) from him, as I did. I quickly learned that FIRST offers an API for theÂ; ;EPSS Model, which immediately piqued my interest. Per FIRST, EPSS provides a fundamentally new capability for efficient, data-driven vulnerability management. While EPSS predicts the probability (threat) of a specific vulnerability being exploited, it can scale to estimate the threat for multiple vulnerabilities on a server, a subnet, mobile device, or at an enterprise level (Jacobs, 2022).
â;;The (EPSS) is a community-driven effort to combine descriptive information about vulnerabilities (CVEs) with evidence of actual exploitation in-the-wild. By collecting and analyzing these data, EPSS seeks to improve vulnerability prioritization by estimating the likelihood that a vulnerability will be exploited. The EPSS model produces a probability score between 0 and 1 (0% and 100%). The higher the score, the greater the probability that a vulnerability will be exploited (in the next 30 days).â;;Â; ;(Jacobs, 2022).
As of February 2022, EPSS version 2 is available; give Jayâ;;;sÂ; ;write-upÂ; ;a good read before proceeding. EPSS v2 is preceded by EPSS v1 andÂ; ;CVSSÂ; ;v3. Note the significant increase in model coverage and efficiency perÂ; ;Figure 1.
Continue reading EPSScall: An Exploit Prediction Scoring System App, (Fri, Jun 10th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, June 10th, 2022 https://isc.sans.edu/podcastdetail.html?id=8044, (Fri, Jun 10th)