Author Archives: SANS Internet Storm Center, InfoCON: green

LOLBAS (“Living Off the Land Binaries And Scripts”) is a list of tools[1] that are present on any Windows system because they are provided by Microsoft as useful tools to perform system maintenance, updates, etc. This list is maintained and upgraded regularly. This is a good starting point when you need to investigate suspicious processes activity on a system (proactively or in forensics investigation).

Continue reading New Tool to Add to Your LOLBAS List: cvtres.exe , (Fri, Oct 1st)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, October 1st, 2021 https://isc.sans.edu/podcastdetail.html?id=7696, (Fri, Oct 1st)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, September 30th, 2021 https://isc.sans.edu/podcastdetail.html?id=7694, (Thu, Sep 30th)→

The Network Time Protocol (NTP) has been critical in ensuring time is accurately kept for various systems businesses and organizations rely on. Authentication mechanisms such as Time-based One-Time Password (TOTP) and Kerberos also rely heavily on time. As such, should there be a severe mismatch in time, users would not be able to authenticate and gain access to systems. From the perspective of incident handling and incident response, well-synchronized time across systems facilitates log analysis, forensic activities and correlation of events. Depending on operational requirements, organizations may choose to utilize public NTP servers for their time synchronization needs. For organizations that require higher time accuracy, they could opt for Global Positioning Systems (GPS) appliances and use daemons such as GPSD [1] to extract time information from these GPS appliances.

Continue reading Keeping Track of Time: Network Time Protocol and a GPSD Bug, (Wed, Sep 29th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, September 29th, 2021 https://isc.sans.edu/podcastdetail.html?id=7692, (Wed, Sep 29th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, September 29th, 2021 https://isc.sans.edu/podcastdetail.html?id=7692, (Wed, Sep 29th)→

It has been over 3 years since the specification for TLS 1.3 was published[1], and although the protocol has some minor drawbacks, it is undoubtedly the most secure TLS version so far. One would therefore hope that the adoption of TLS 1.3 and its use on web servers around the globe would steadily increase over time (ideally hand in hand with a slow disappearance of older cryptographic protocols, especially the historic SSL 2.0 and SSL 3.0).

Continue reading TLS 1.3 and SSL – the current state of affairs, (Tue, Sep 28th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, September 28th, 2021 https://isc.sans.edu/podcastdetail.html?id=7690, (Tue, Sep 28th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, September 28th, 2021 https://isc.sans.edu/podcastdetail.html?id=7690, (Tue, Sep 28th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, September 27th, 2021 https://isc.sans.edu/podcastdetail.html?id=7688, (Mon, Sep 27th)→