Collaborate Disseminate
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, June 10th, 2022 https://isc.sans.edu/podcastdetail.html?id=8044, (Fri, Jun 10th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, June 9th, 2022 https://isc.sans.edu/podcastdetail.html?id=8042, (Thu, Jun 9th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, June 8th, 2022 https://isc.sans.edu/podcastdetail.html?id=8040, (Wed, Jun 8th)
Last week, Atlassian patched an unauthenticated remote code execution vulnerability in its Confluence Server and Data Center products. Confluence is a “Wiki” like product used by software development teams to document and organize the software development process. I would expect that most Atlassian customers use the cloud-hosted version of the software managed by Atlassian. But if you are running your own Atlassian server, you had to patch this yourself. Sadly, the vulnerability was discovered after it had already been exploited. The vulnerability was originally discovered by Volexity during incident response [2]. Once the details became known, creating new exploits was made easier due to similar vulnerabilities affecting Atlassian products in the past.
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, June 7th, 2022 https://isc.sans.edu/podcastdetail.html?id=8038, (Tue, Jun 7th)
In yesterday&#;x26;#;39;s analysis “Analysis Of An “ms-msdt” RTF Maldoc“, I forgot to include the output of my oledump plugin plugin_clsid.
Continue reading “ms-msdt” RTF Maldoc Analysis: oledump Plugins, (Mon, Jun 6th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, June 6th, 2022 https://isc.sans.edu/podcastdetail.html?id=8036, (Mon, Jun 6th)
Malicious document “aaa.rtf” is an RTF file that downloads a html file that uses the ms-msdt handler to get a PowerShell script executed. This is explained in our diary entry “New Microsoft Office Attack Vector via “ms-msdt” Protocol Scheme (CVE-2022-30190)“.
Continue reading Analysis Of An “ms-msdt” RTF Maldoc, (Sun, Jun 5th)
This zipped email attachment was received a few days ago and block by antispam policy. It contained a very large ISO/EXE file similar to the diary published by Zavier [1] last week. Instead of using Remnux, I submitted this file to a sandbox.
Continue reading Spam Email Contains a Very Large ISO file, (Sat, Jun 4th)