Collaborate Disseminate
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, December 28th, 2021 https://isc.sans.edu/podcastdetail.html?id=7812, (Tue, Dec 28th)
Microsoft Build Engine is the platform for building applications on Windows, mainly used in environments where Visual Studio is not installed. Also known as MSBuild, the engine provides an XML schema for a project file that controls how the build platform processes and builds software [1]. The project file element named ‘Tasks’ designates independent executable components to run during the project building. Tasks are meant to perform build operations but are being abused by attackers to run malicious code under the MSBuild disguise. The technique is mapped on Mitre ATT&CK as â€Trusted Developer Utilities Proxy Execution†– T1127.001.
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, December 27th, 2021 https://isc.sans.edu/podcastdetail.html?id=7810, (Mon, Dec 27th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, December 27th, 2021 https://isc.sans.edu/podcastdetail.html?id=7810, (Mon, Dec 27th)
When you use TShark&#;x26;#;39;s option -e to display a field value, you need to include option -Tfields.
Continue reading Quicktip: TShark’s Options -e and -T, (Sun, Dec 26th)
TShark is WireShark&#;x26;#;39;s console program: it&#;x26;#;39;s like WireShark, but with a command-line interface in stead of a GUI.
Continue reading TShark Tip: Extracting Field Values From Capture Files, (Sat, Dec 25th)
While following Log4Shell';s exploit attempts hitting our honeypots, I came across another campaign trying to push a crypto miner on the victim’s machines. The previous campaign I analyzed used a simple post-exploitation Powershell script to download and launch the coin miner xmrig. The new one uses a .Net launcher to download, decrypt, and execute the binaries.
Thanks to Mick Douglas for contributing these notes on defending against log4shell exploits targeting cloud Internal Meta Data Services (IMDS)
Continue reading Defending Cloud IMDS Against log4shell (and more), (Thu, Dec 23rd)
Are you running an application in a cloud environment like Amazon&#;x26;#;39;s EC2? Cloud providers usually offer a nifty way to manage credentials: Internal Meta Data Services (IMDS). For AWS, the IMDS listens on 169.254.169.254. 169.254/16 being link-local only, only code running on the host itself can reach it, and your code can use this service to retrieve credentials. Or, well, any code running on the host can.
Continue reading log4shell and cloud provider internal meta data services (IMDS), (Thu, Dec 23rd)
Phishing campaigns are a real plague on the Internet. Every day our mailboxes are flooded via fake emails pretending to be from common online services like Paypal, DHL, Netflix, and many more. Microsoft Office365 is also a good candidate for phishing campaigns.
Continue reading Nicely Crafted indeed.com Login Page, (Thu, Dec 23rd)