Collaborate Disseminate
In so many penetration tests or assessments, the client gives you a set of subnets and says “go for it”. This all seems reasonable, until you realize that if you have a website, there might be dozens or hundreds of websites hosted there, each only accessible by their DNS name.
Continue reading Using Passive DNS sources for Reconnaissance and Enumeration, (Fri, Apr 29th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, April 29th, 2022 https://isc.sans.edu/podcastdetail.html?id=7986, (Fri, Apr 29th)
After Microsoft patched and went public with &#;x26;#;x25;&#;x26;#;x25;CVE:2022-26809&#;x26;#;x25;&#;x26;#;x25;, the recent RPC vulnerability, we set up a complete Windows 10 system exposing port 445/TCP “to the world.” The system is not patched for the RPC vulnerability. And to keep things more interesting, we are forwarding traffic from a subset of our honeypots to the system. This gives us a pretty nice cross-section and keeps the system pretty busy. Other than not applying the April patches, the system isn&#;x26;#;39;t particularly vulnerable and is left in the default configuration (firewall disabled, of course).
Continue reading A Day of SMB: What does our SMB/RPC Honeypot see? CVE-2022-26809, (Thu, Apr 28th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, April 28th, 2022 https://isc.sans.edu/podcastdetail.html?id=7984, (Thu, Apr 28th)
MITRE ATT&CK has long been the de facto standard for sharing TTPs of different threat actors and for planning and executing various threat emulation exercises. However, especially in the last few years, I’ve seen more and more Security Operations Centers start using it as well, for mapping of their defensive capabilities, detection use cases and SIEM correlation rules.
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, April 27th, 2022 https://isc.sans.edu/podcastdetail.html?id=7982, (Wed, Apr 27th)
While investigating a malicious crypto-mining case, I discovered that attackers implanted the payload exploiting a recently patched RCE vulnerability (CVE-2022-29464) affecting multiple WSO2 products, including API Manager. The vulnerability was discovered by Orange Tsai and responsibly disclosed to WSO2.
Continue reading WSO2 RCE exploited in the wild, (Tue, Apr 26th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, April 26th, 2022 https://isc.sans.edu/podcastdetail.html?id=7980, (Tue, Apr 26th)
Last week, I found an interesting piece of phishing based on a PDF file. Today, most of the PDF files that are delivered to end-user are not malicious, I mean that they don’t contain an exploit to trigger a vulnerability and infect the victim’s computer. They are just used as a transport mechanism to deliver more malicious content. Yesterday, Didier analyzed the same kind of Word document[1]. They are more and more common because they are (usually) not blocked by common filters at the perimeter.
Continue reading Simple PDF Linking to Malicious Content, (Mon, Apr 25th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, April 25th, 2022 https://isc.sans.edu/podcastdetail.html?id=7978, (Mon, Apr 25th)