Author Archives: SANS Internet Storm Center, InfoCON: green

NetWitness has the ability to load Snort rules on its PacketDecoder to detect and alert suspicious activity. Since it is practical to be able to see the signature makeup and what it is looking for, I created a script that parses the Snort rule tarball into a single file (list.rules), which can be pushed and loaded in all the PacketDecoders. The scripts also parse each signature into a single HTML file that can be queried to review the signature to understand what the alert is matching.

Continue reading Using Snort IDS Rules with NetWitness PacketDecoder, (Sat, Feb 26th)→

APIPA stands for Automatic Private IP Addressing. It’s Microsoft Windows’ mechanism to assign an IPv4 address to a network adapter when no DHCP server is offering an address.

Continue reading Windows, Fixed IPv4 Addresses and APIPA, (Fri, Feb 25th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, February 25th, 2022 https://isc.sans.edu/podcastdetail.html?id=7896, (Fri, Feb 25th)→

For a few days, the eyes of the world are on the situation between Russia and Ukraine. Today, operations are also organized in the “cyber” dimension (besides the classic ones – land, air, sea, and space). This new dimension is not only used for attacks like DDoS against the enemy but also for propaganda. Involved parties will be spreading fake news or bad guys may try to steal your data or some money.

Continue reading Ukraine & Russia Situation From a Domain Names Perspective , (Thu, Feb 24th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, February 24th, 2022 https://isc.sans.edu/podcastdetail.html?id=7894, (Thu, Feb 24th)→

December 10th, 2021, the Apache Foundation published a security advisory for log4j2 releasing a patch for %%cve:2021-44228%%. This vulnerability became later known as “log4shell”. Shortly after the release of the initial vulnerability, two more were made public for variants of the initial problem.

Continue reading The Rise and Fall of log4shell, (Wed, Feb 23rd)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, February 23rd, 2022 https://isc.sans.edu/podcastdetail.html?id=7892, (Wed, Feb 23rd)→

Here is another sample demonstrating how attackers still rely on good old vulnerabilities&#;x26;#;xe2;&#;x26;#;x80;&#;x26;#;xa6;&#;x26;#;xc2;&#;x26;#;xa0; In 2017, Microsoft Office suffered from a critical vulnerability that affected its Equation Editor tool, known as CVE-2017-11882&#;x26;#;x5b;1&#;x26;#;x5d;. It&#;x26;#;39;s a memory corruption vulnerability that leads to remote code execution, pretty bad. It was heavily exploited at this time and I was curious to find a new document spread with the same good old vulnerability.

Continue reading A Good Old Equation Editor Vulnerability Delivering Malware, (Tue, Feb 22nd)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, February 22nd, 2022 https://isc.sans.edu/podcastdetail.html?id=7890, (Tue, Feb 22nd)→

Do you recognize the following situation?

Continue reading Sending an Email to an IPv4 Address?, (Mon, Feb 21st)→