Collaborate Disseminate
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, June 21st, 2021 https://isc.sans.edu/podcastdetail.html?id=7550, (Mon, Jun 21st)
When you&#;x26;#;39;re facing some suspicious files while performing forensic investigations or analyzing malware components, it&#;x26;#;39;s always interesting to know these files are legit or malicious/modified. One of the key sources to verify hashes is provided by NIST and is called the NSLR project (“National Software Reference Library”)[1]. They build “Reference Data Set” (RDS) of information that can be queried to verify a file hash. These RDS are available to download[2] but, as you may expect, there are huge (they are provided as ISO files between 500MB to 4GB!)
Continue reading Easy Access to the NIST RDS Database, (Sat, Jun 19th)
Working from home, did you get a meeting invite recently that pointed to https://meet.google.com &#;x26;#;x3f;&#;x26;#;xc2;&#;x26;#;xa0; Well, that&#;x26;#;39;s indeed where Google&#;x26;#;39;s online meeting tool is located. But potentially the URL you got is not “only” leading you there.
Continue reading Open redirects … and why Phishers love them, (Fri, Jun 18th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, June 18th, 2021 https://isc.sans.edu/podcastdetail.html?id=7548, (Fri, Jun 18th)
In yesterday&#;x26;#;39;s diary, we took a look at two methods that allow to capture network connection information off a potentially compromised virtual machine in Azure. Today, we&#;x26;#;39;ll investigate the most recent addition to the VM monitoring arsenal, namely “Azure Monitor Insights”.
Continue reading Network Forensics on Azure VMs (Part #2), (Fri, Jun 18th)
The tooling to investigate a potentially malicious event on an Azure Cloud VM is still in its infancy. We have covered before (Forensicating Azure VMs) how we can create a snapshot of the OS disk of a running VM. Snapshotting and then killing off the infected VM is very straight forward, but it also tips off an intruder that he has been found out. Sometimes, it makes sense to first watch for a while, and learn more, for example about compromised accounts, lateral movement, or other involved hosts.
Continue reading Network Forensics on Azure VMs (Part #1), (Thu, Jun 17th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, June 17th, 2021 https://isc.sans.edu/podcastdetail.html?id=7546, (Thu, Jun 17th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, June 16th, 2021 https://isc.sans.edu/podcastdetail.html?id=7544, (Wed, Jun 16th)