Author Archives: SANS Internet Storm Center, InfoCON: green
Remote Desktop Protocol (RDP) Discovery, (Sat, Oct 30th)
I have noticed a surge in probe against the RDP service in the past 2 weeks. In August, a remote code execution (RCE) critical patch was released to fix an exploit related to CVE-2021-34535 which include a POC to exploit this vulnerability. This vulnerability is also affecting Microsoft Hyper-V Manager âEnhanced Session Modeâ [5] and Microsoft Defender’s Application Guard (WDAG) [6].
Continue reading Remote Desktop Protocol (RDP) Discovery, (Sat, Oct 30th)
ISC Stormcast For Friday, October 29th, 2021 https://isc.sans.edu/podcastdetail.html?id=7734, (Fri, Oct 29th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, October 29th, 2021 https://isc.sans.edu/podcastdetail.html?id=7734, (Fri, Oct 29th)
Multiple Apple Patches for October 2021, (Thu, Oct 28th)
With the recent release of macOS Monterey 12.0.1, multiple security vulnerabilities were addressed [1]. For users who were not keen to update to macOS Monterey either due to personal or operational reasons, security updates for macOS Catalina [2] and macOS Big Sur [3] were also made available.
Continue reading Multiple Apple Patches for October 2021, (Thu, Oct 28th)
ISC Stormcast For Thursday, October 28th, 2021 https://isc.sans.edu/podcastdetail.html?id=7732, (Thu, Oct 28th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, October 28th, 2021 https://isc.sans.edu/podcastdetail.html?id=7732, (Thu, Oct 28th)
ISC Stormcast For Wednesday, October 27th, 2021 https://isc.sans.edu/podcastdetail.html?id=7730, (Wed, Oct 27th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, October 27th, 2021 https://isc.sans.edu/podcastdetail.html?id=7730, (Wed, Oct 27th)
Hunting for Phishing Sites Masquerading as Outlook Web Access, (Tue, Oct 26th)
It has been a while since I hunted for phishing sites. I recently found one, and will briefly highlight the interesting observations I gleaned from analyzing the particular phishing site I discovered.
Continue reading Hunting for Phishing Sites Masquerading as Outlook Web Access, (Tue, Oct 26th)
ISC Stormcast For Tuesday, October 26th, 2021 https://isc.sans.edu/podcastdetail.html?id=7728, (Tue, Oct 26th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, October 26th, 2021 https://isc.sans.edu/podcastdetail.html?id=7728, (Tue, Oct 26th)
Decrypting Cobalt Strike Traffic With a “Leaked” Private Key, (Mon, Oct 25th)
Cobalt Strike C2 traffic is encrypted with AES. The AES key is randomly generated by the beacon, and communicated to the team server via RSA encrypted metadata. The beacon contains the public RSA key, and the team server the private RSA key.
Continue reading Decrypting Cobalt Strike Traffic With a “Leaked” Private Key, (Mon, Oct 25th)
ISC Stormcast For Monday, October 25th, 2021 https://isc.sans.edu/podcastdetail.html?id=7726, (Mon, Oct 25th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, October 25th, 2021 https://isc.sans.edu/podcastdetail.html?id=7726, (Mon, Oct 25th)