Collaborate Disseminate
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, June 3rd, 2022 https://isc.sans.edu/podcastdetail.html?id=8034, (Fri, Jun 3rd)
Today, many sandbox solutions are available and deployed by most organizations to detonate malicious files and analyze their behavior. The main problem with some sandboxes is the filename used to submit the sample. The file can be named like “sample.exe”, “suspicious.exe”, “.tmp” or “malware.tmp”.
Continue reading Sandbox Evasion… With Just a Filename!, (Fri, Jun 3rd)
[This is a guest post written by Logan Flook, one of our SANS.edu undergraduate interns https://www.linkedin.com/in/loganflook]
Continue reading Quick Answers in Incident Response: RECmd.exe, (Thu, Jun 2nd)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, June 2nd, 2022 https://isc.sans.edu/podcastdetail.html?id=8032, (Thu, Jun 2nd)
It can be interesting to see how phishing evolves over time. It was not that long ago that that a phishing message, which didn’t require the victim to click a link in order for them to be directed to a phishing site, but rather contained the entire JavaScript-based credential stealing page in a well-made HTML attachment was noteworthy[1,2]. Nevertheless, over time, this technique, as well as many others, has become ubiquitous, and e-mail security scanners have become more capable of detecting and stopping messages that use it. Similar improvements of course force threat actors who specialize in phishing to continuously improve their creations in order for them to be viable.
Continue reading HTML phishing attachments – now with anti-analysis features, (Wed, Jun 1st)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, June 1st, 2022 https://isc.sans.edu/podcastdetail.html?id=8030, (Wed, Jun 1st)
For a few days, “Follina” is generating a lot of noise on the Internet, check our yesterday diary[1] about this new vulnerability if you need more details. It was time to hunt for some samples. For this purpose, I created a simple YARA rule on VT:
Continue reading First Exploitation of Follina Seen in the Wild, (Tue, May 31st)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, May 31st, 2022 https://isc.sans.edu/podcastdetail.html?id=8028, (Mon, May 30th)
Update: We now have an official blog post from Microsoft:
Guidance for CVE-2022-30190 Microsoft Support Diagnostic Tool Vulnerability.
In diary entries “Huge Signed PE File” and “Huge Signed PE File: Keeping The Signature” I explain how to get rid of the overlay in a huge PE file.
Continue reading Extracting The Overlay Of A PE File, (Sun, May 29th)