Collaborate Disseminate
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, March 21st, 2022 https://isc.sans.edu/podcastdetail.html?id=7928, (Mon, Mar 21st)
Reader Markus reported TCP connections on his servers with data that starts with MGLNDD_*.
Yesterday, our honeypots started seeing many requests scanning for the Movable Type API. Movable Type is a content management system comparable to WordPress or Drupal. Unlike the other two written in PHP, Movable Type uses a Perl backend. Movable Type also has no free version available [MTABOUT].
Continue reading Scans for Movable Type Vulnerability (CVE-2021-20837), (Fri, Mar 18th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, March 18th, 2022 https://isc.sans.edu/podcastdetail.html?id=7926, (Fri, Mar 18th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, March 17th, 2022 https://isc.sans.edu/podcastdetail.html?id=7924, (Thu, Mar 17th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, March 16th, 2022 https://isc.sans.edu/podcastdetail.html?id=7922, (Wed, Mar 16th)
EDR or “Endpoint Detection & Response” is a key element of many networks today. An agent is installed on all endpoints to track suspicious/malicious activity and (try to) block it. Behavioral monitoring is also a key element in modern SIEM infrastructure: To see a word.exe running is definitively not malicious, same with a Powershell script being launched. But if you monitor parent/child relations, to see a Powershell script launched from a Word process, that is suspicious! Here is a simple Sigma[1] rule to detect this behavior:
Continue reading Clean Binaries with Suspicious Behaviour, (Tue, Mar 15th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, March 15th, 2022 https://isc.sans.edu/podcastdetail.html?id=7920, (Tue, Mar 15th)