Author Archives: SANS Internet Storm Center, InfoCON: green

In diary entry “Decrypting Cobalt Strike Traffic With a “Leaked” Private Key” I showed how to decrypt Cobalt Strike network traffic with private RSA keys.

Continue reading Decrypting Cobalt Strike Traffic With Keys Extracted From Process Memory, (Sat, Nov 6th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, November 5th, 2021 https://isc.sans.edu/podcastdetail.html?id=7744, (Fri, Nov 5th)→

Recently I&#;x26;#;39;ve been doing a lot of imaging and mounting different image format types. Xmount(1) has been very handy and not something I&#;x26;#;39;ve used a lot in the past. Xmount can do DD, EWF (Expert Witness Compression Format), or AFF. While mount disks haven&#;x26;#;39;t changed a lot, having a combined utility that can do the significant files types makes it more accessible.

Continue reading Xmount for Disk Images, (Thu, Nov 4th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, November 4th, 2021 https://isc.sans.edu/podcastdetail.html?id=7742, (Thu, Nov 4th)→

Introduction

Continue reading October 2021 Forensic Contest: Answers and Analysis, (Thu, Nov 4th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, November 3rd, 2021 https://isc.sans.edu/podcastdetail.html?id=7740, (Wed, Nov 3rd)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, November 2nd, 2021 https://isc.sans.edu/podcastdetail.html?id=7738, (Tue, Nov 2nd)→

I had previously written about the impacts and implications of BrakTooth in a previous diary [1]. As a brief recap, BrakTooth is a family of Bluetooth Classic vulnerabilities that were mainly caused by non-compliance to Bluetooth Core Specifications and their respective communication protocol layers. It has been about 2 months since BrakTooth was announced, so let us take a look at how things have progressed so far.

Continue reading Revisiting BrakTooth: Two Months Later, (Mon, Nov 1st)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, November 1st, 2021 https://isc.sans.edu/podcastdetail.html?id=7736, (Mon, Nov 1st)→

This is a video for my diary entry “Phishing ZIP With Malformed Filename“, where I show how to use my zipdump.py tool to visualize the special characters inside malformed filenames.

Continue reading Video: Phishing ZIP With Malformed Filename, (Sun, Oct 31st)→