Author Archives: SANS Internet Storm Center, InfoCON: green

Wireshark version 3.6.0 was released.

Continue reading Wireshark 3.6.0 Released, (Mon, Nov 29th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, November 29th, 2021 https://isc.sans.edu/podcastdetail.html?id=7772, (Mon, Nov 29th)→

In this video, I show and explain the YARA rules I covered in diary entries “Extra Tip For Triage Of MALWARE Bazaar&#;x26;#;39;s Daily Malware Batches” , “Simple YARA Rules for Office Maldocs” and “YARA Rule for OOXML Maldocs: Less False Positives“.

Continue reading Video: YARA Rules for Office Maldocs, (Sun, Nov 28th)→

In this video, I show and explain the YARA rules I covered in diary entries “Extra Tip For Triage Of MALWARE Bazaar&#;x26;#;39;s Daily Malware Batches” , “Simple YARA Rules for Office Maldocs” and “YARA Rule for OOXML Maldocs: Less False Positives“.

Continue reading Video: YARA Rules for Office Maldocs, (Sun, Nov 28th)→

The 2021 SANS Holiday Hack Challenge begins mid-December, but you can already watch “SANS Holiday Hack Challenge 2021 Q&A with Ed Skoudis” on YouTube.

Continue reading Video: SANS Holiday Hack Challenge 2021 Q&A with Ed Skoudis, (Sat, Nov 27th)→

Over the past 7 days, my honeypot captured a few hundred POST for a vulnerability which appeared to be tracked as a critical path traversal vulnerability in the web interfaces of routers with Arcadyan firmware. If successfully exploited, could allow unauthenticated remote actors to bypass authentication and add the router to the botnet Mirai botnet.

Continue reading Searching for Exposed ASUS Routers Vulnerable to CVE-2021-20090, (Fri, Nov 26th)→

YARA supports private strings.

Continue reading YARA’s Private Strings, (Thu, Nov 25th)→

It can be instructive to closely examine even completely usual-looking phishing messages from time to time, since they may lead one to unusual phishing sites[1] or may perhaps use some novel technique that might not be obvious at first glance[2].

Continue reading Phishing page hiding itself using dynamically adjusted IP-based allow list, (Wed, Nov 24th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, November 24th, 2021 https://isc.sans.edu/podcastdetail.html?id=7770, (Wed, Nov 24th)→

In this diary entry, I introduce an updated version of the YARA rule I presented in diary entry “Simple YARA Rules for Office Maldocs” for OOXML files with VBA code. Here is the OOXML YARA rule I presented yesterday:

Continue reading YARA Rule for OOXML Maldocs: Less False Positives, (Tue, Nov 23rd)→