Collaborate Disseminate
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, February 3rd, 2022 https://isc.sans.edu/podcastdetail.html?id=7864, (Thu, Feb 3rd)
elFinder is an interesting open-source project implementing a file manager in JavaScript and PHP. The file manager promises a user experience similar to the “Finder” in macOS. Once you have elFinder installed, uploading/downloading files to your web server will be a lot easier.
Continue reading Finding elFinder: Who is looking for your files?, (Wed, Feb 2nd)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, February 2nd, 2022 https://isc.sans.edu/podcastdetail.html?id=7862, (Wed, Feb 2nd)
The word “automation” is on everyone&#;x26;#;39;s lips for a while. We need to perform tasks as fast as possible and we develop or use tools to automate as much as possible. Also because we are lazzy people (well, honestly, I am ;-), if you can solve annoying tasks with a few lines of Python, go ahead! But results must be controlled and validated. Expecially when you perform scans or vulnerability assessments. It&#;x26;#;39;s so easy to drop a device on a network with a bunch of tools and start to scan everything.
Continue reading Automation is Nice But Don’t Replace Your Knowledge, (Tue, Feb 1st)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, February 1st, 2022 https://isc.sans.edu/podcastdetail.html?id=7860, (Tue, Feb 1st)
Not many people are aware of “.rpmsg†files. The file extension means “restricted-permission messageâ€. They are used to deliver email messages between people and implement some controls applied at the recipient side. Such permissions are, by example, the right to forward or copy the original email. You may compare this to some kind of “DRM†(Digital Rights Management) for emails. RPMSG files are used inside a Microsoft ecosystem because they are created by users of Azure Information Protection, or Active Directory Rights Management Services[1]. The file is encrypted and only the recipient will be able to decrypt and open the message.
Continue reading Be careful with RPMSG files, (Mon, Jan 31st)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, January 31st, 2022 https://isc.sans.edu/podcastdetail.html?id=7858, (Mon, Jan 31st)
YARA release candidate 1 for version 4.2.0 introduces a new module: console.
My first exposure to a SIEM in 2001 was netForensics followed by Intellitactics (2002) which was eventually purchase by Trustwave but since then, many new products have come to market.
Continue reading SIEM In this Decade, Are They Better than the Last?, (Sat, Jan 29th)
I spotted an interesting phishing email. As usual, the message was delivered with a malicious attachment that is a simple HTML page called &#;x26;#;xe2;&#;x26;#;x80;&#;x26;#;x9c;Order&#;x26;#;x5f;Receipt.html&#;x26;#;xe2;&#;x26;#;x80;&#;x26;#;x9d;&#;x26;#;xc2;&#;x26;#;xa0;(SHA256:a0989ec9ad1b74c5e8dedca4a02dcbb06abdd86ec05d1712bfc560bf209e3b39) with a low VT score of 5/59&#;x26;#;x5b;1&#;x26;#;x5d;&#;x26;#;x21; This is a text file and, therefore, looks less suspicious.&#;x26;#;xc2;&#;x26;#;xa0;When the page is opened in the victim&#;x26;#;39;s&#;x26;#;xc2;&#;x26;#;xa0;browser, it displays a simple message and offers the victim to download an ISO file:
Continue reading Malicious ISO Embedded in an HTML Page, (Fri, Jan 28th)