Author Archives: SANS Internet Storm Center, InfoCON: green
The new “LinkedInSecureMessage” ?, (Wed, Feb 17th)
[This is a guest diary by JB Bowers – @cherokeejb_]
Continue reading The new “LinkedInSecureMessage” ?, (Wed, Feb 17th)
ISC Stormcast For Wednesday, February 17th, 2021 https://isc.sans.edu/podcastdetail.html?id=7376, (Wed, Feb 17th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, February 17th, 2021 https://isc.sans.edu/podcastdetail.html?id=7376, (Wed, Feb 17th)
More weirdness on TCP port 26, (Tue, Feb 16th)
A little over a year ago, I wrote a diary asking what was going on with traffic on TCP %%port:26%%. So, last week when I noticed another spike on port 26, I decided to take another look.
Continue reading More weirdness on TCP port 26, (Tue, Feb 16th)
ISC Stormcast For Tuesday, February 16th, 2021 https://isc.sans.edu/podcastdetail.html?id=7374, (Tue, Feb 16th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, February 16th, 2021 https://isc.sans.edu/podcastdetail.html?id=7374, (Tue, Feb 16th)
Securing and Optimizing Networks: Using pfSense Traffic Shaper Limiters to Combat Bufferbloat, (Mon, Feb 15th)
[This is a guest diary by Yee Ching Tok (personal website here (https://poppopretn.com)). Feedback welcome either via comments or our contact page (https://isc.sans.edu/contact.html)]
ISC Stormcast For Monday, February 15th, 2021 https://isc.sans.edu/podcastdetail.html?id=7372, (Mon, Feb 15th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, February 15th, 2021 https://isc.sans.edu/podcastdetail.html?id=7372, (Mon, Feb 15th)
Video: tshark & Malware Analysis, (Sun, Feb 14th)
In this video, I show the commands I used in diary entry “Quickie: tshark & Malware Analysis” to analyze shellcode from a pcapng file, and I also show some basic options and feature of tshark, the command-line version of Wireshark.
Continue reading Video: tshark & Malware Analysis, (Sun, Feb 14th)
Using Logstash to Parse IPtables Firewall Logs, (Sat, Feb 13th)
One of our reader submitted some DSL Modem Firewall logs (iptables format) and I wrote a simple logstash parser to analyze and illustrate the activity, in this case it is all scanning activity against this modem. An iptables parser exist for Filebeat[2], but for this example, I wanted to show how to create a simple logstash parser using Grok[3] to parse these logs and send them to Elastic.
Continue reading Using Logstash to Parse IPtables Firewall Logs, (Sat, Feb 13th)
vSphere Replication updates address a command injection vulnerability (CVE-2021-21976) – https://www.vmware.com/security/advisories/VMSA-2021-0001.html, (Sat, Feb 13th)
———–
Guy Bruneau IPSS Inc.
My Handler Page
Twitter: GuyBruneau
gbruneau at isc dot sans dot edu