Collaborate Disseminate
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, August 4th, 2021 https://isc.sans.edu/podcastdetail.html?id=7614, (Tue, Aug 3rd)
I hope this doesn&#;x26;#;39;t work… no comment otherwise.
Continue reading Is this the Weirdest Phishing (SMishing?) Attempt Ever?, (Tue, Aug 3rd)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, August 3rd, 2021 https://isc.sans.edu/podcastdetail.html?id=7612, (Tue, Aug 3rd)
I often use Windows BAT files, simple ones, to execute a series of commands. And over the years, I learned not to change these BAT files while they were executing, because cmd.exe would “notice” those changes when it has to execute the next command in the BAT file, and read the changed file, leading to undesired results.
Continue reading Changing BAT Files On The Fly, (Mon, Aug 2nd)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Sunday, August 1st, 2021 https://isc.sans.edu/podcastdetail.html?id=7610, (Sun, Aug 1st)
A new version of procdump, the Sysinternals tool to create process dumps, was released.
This week I started seeing more DNS related activity being identified by Threatintel and that got me curious. While reviewing my logs, I noticed that Wednesday and Thursday had an unusual spike for many inbound unsolicited DNS queries for the domain census.gov.
Yesterday, I reported a piece of malware that uses&#;x26;#;xc2;&#;x26;#;xa0;archive.org to fetch its next stage&#;x26;#;x5b;1&#;x26;#;x5d;. Today, I spotted another file that is also interesting: A Windows Registry file (with a “.reg” extension). Such files are&#;x26;#;xc2;&#;x26;#;xa0;text&#;x26;#;xc2;&#;x26;#;xa0;files created by exporting values from the Registry (export) but they can also&#;x26;#;xc2;&#;x26;#;xa0;be used to add or change values in the Registry (import). Being text files, they don&#;x26;#;39;t look suspicious.
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, July 30th, 2021 https://isc.sans.edu/podcastdetail.html?id=7608, (Fri, Jul 30th)