YARA v4.0.5, (Sat, Feb 6th)
YARA version 4.0.5 was released.
Author Archives: SANS Internet Storm Center, InfoCON: green
VBA Macro Trying to Alter the Application Menus, (Fri, Feb 5th)
Who remembers the worm Melissa&#;x26;#;x5b;1&#;x26;#;x5d;&#;x26;#;x3f; It started to spread in March 1999&#;x26;#;x21; In information security, it looks like speaking about&#;x26;#;xc2;&#;x26;#;xa0;prehistory but I spotted a VBA macro that tried to use the same defensive technique as Melissa. Yes, back in 1999, attackers already tried to use techniques to defeat users&#;x26;#;39; protections. The sample macro has a low VT score (7/44) (SHA256:386e1a60011ff0a818adff8c638005ec5015930c1b35d06cacc11f3ab53725d0)&#;x26;#;x5b;2&#;x26;#;x5d;.
Continue reading VBA Macro Trying to Alter the Application Menus, (Fri, Feb 5th)
ISC Stormcast For Friday, February 5th, 2021 https://isc.sans.edu/podcastdetail.html?id=7360, (Fri, Feb 5th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, February 5th, 2021 https://isc.sans.edu/podcastdetail.html?id=7360, (Fri, Feb 5th)
Abusing Google Chrome extension syncing for data exfiltration and C&C, (Thu, Feb 4th)
I had a pleasure (or not) of working on another incident where, among other things, attackers were using a pretty novel way of exfiltrating data and using that channel for C&C communication. Some of the methods observed in analyzed code were pretty scary â from a defender’s point of view, as you will see further below in this diary.
ISC Stormcast For Thursday, February 4th, 2021 https://isc.sans.edu/podcastdetail.html?id=7358, (Thu, Feb 4th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, February 4th, 2021 https://isc.sans.edu/podcastdetail.html?id=7358, (Thu, Feb 4th)
ISC Stormcast For Wednesday, February 3rd, 2021 https://isc.sans.edu/podcastdetail.html?id=7356, (Wed, Feb 3rd)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, February 3rd, 2021 https://isc.sans.edu/podcastdetail.html?id=7356, (Wed, Feb 3rd)
Excel spreadsheets push SystemBC malware, (Wed, Feb 3rd)
New Example of XSL Script Processing aka “Mitre T1220”, (Tue, Feb 2nd)
Last week, Brad posted a diary about TA551[1]. A few days later, one of our readers submitted another sample belonging to the same campaign. Brad had a look at the traffic so I decided to have a look at the macro, not because the code is heavily obfuscated but data are spread at different locations in the Word document.
Continue reading New Example of XSL Script Processing aka “Mitre T1220”, (Tue, Feb 2nd)
ISC Stormcast For Tuesday, February 2nd, 2021 https://isc.sans.edu/podcastdetail.html?id=7354, (Tue, Feb 2nd)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, February 2nd, 2021 https://isc.sans.edu/podcastdetail.html?id=7354, (Tue, Feb 2nd)
Taking a Shot at Reverse Shell Attacks, CNC Phone Home and Data Exfil from Servers, (Mon, Feb 1st)
Over the last number of weeks (after the Solarwinds Orion news) there&#;x26;#;39;s been a lot of discussion on how to detect if a server-based applcation is compromised. The discussions have ranged from buying new sophisticated tools, auditing the development pipeline, to diffing patches. But really, for me it&#;x26;#;39;s as simple as saying “should my application server really be able to connect to any internet host on any protocol”. Let&#;x26;#;39;s take it one step further and say “should my application server really be able to connect to arbitrary hosts on tcp/443 or udp/53 (or any other protocol)”. And when you phrase it that way, the answer really should be a simple “no”.