Collaborate Disseminate
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, March 2nd, 2021 https://isc.sans.edu/podcastdetail.html?id=7394, (Tue, Mar 2nd)
Going back a few weeks, we discussed how DNS over HTTPS (DoH) works (https://isc.sans.edu/forums/diary/Fun&#;x26;#;x2b;with&#;x26;#;x2b;NMAP&#;x26;#;x2b;NSE&#;x26;#;x2b;Scripts&#;x26;#;x2b;and&#;x26;#;x2b;DOH&#;x26;#;x2b;DNS&#;x26;#;x2b;over&#;x26;#;x2b;HTTPS/27026/)&#;x26;#;xc2;&#;x26;#;xa0; – very much as an unauthenticated API over HTTPS.&#;x26;#;xc2;&#;x26;#;xa0; But DNS over TLS (DoT) has been with us for a fair bit longer (May 2016), why haven&#;x26;#;39;t we heard about it so much?
Continue reading Fun with DNS over TLS (DoT), (Mon, Mar 1st)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, March 1st, 2021 https://isc.sans.edu/podcastdetail.html?id=7392, (Mon, Mar 1st)
In diary entry “Unprotecting Malicious Documents For Inspection” I explain how to deal with protected malicious Excel documents by removing the protection passwords.
Continue reading Maldocs: Protection Passwords, (Sun, Feb 28th)
I received this phishing email yesterday that seemed very strange with this short and urgent message:
Continue reading Pretending to be an Outlook Version Update, (Fri, Feb 26th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, February 26th, 2021 https://isc.sans.edu/podcastdetail.html?id=7390, (Fri, Feb 26th)
Last week I posted about a new Satori variant scanning on TCP port 26 that I was picking up in my honeypots. Things have slowed down a bit, but levels are still above where they had been since mid-July 2020 on %%port:26%%.
Continue reading So where did those Satori attacks come from?, (Thu, Feb 25th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, February 25th, 2021 https://isc.sans.edu/podcastdetail.html?id=7388, (Thu, Feb 25th)
With more and more workloads migrating to “the Cloud”, we see post-breach forensic investigations also increasingly moving from on-premises to remote instances. If we are lucky and the installation is well engineered, we will encounter a “managed” virtual machine setup, where a forensic agent or EDR (endpoint detection & response) product is pre-installed on our affected VM. Alas, in my experience, this so far seems to be the exception rather than the norm. It almost feels like some lessons learned in the past two decades about EDR have been thrown out again, just because … “Cloud”.
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, February 24th, 2021 https://isc.sans.edu/podcastdetail.html?id=7386, (Wed, Feb 24th)