Author Archives: SANS Internet Storm Center, InfoCON: green

If you’re a regular reader of our Diaries, you may remember that over the last year and a half, a not insignificant portion of my posts has been devoted to discussing some of the trends in internet-connected systems. We looked at changes in the number of internet-facing machines affected by BlueKeep[1], SMBGhost[2], Shitrix[3] and several other vulnerabilities [4] as well as at the changes in TLS 1.3 support over time[5] and several other areas [6,7]. Today, we’re going to take a look at the tool, that I’ve used to gather data, on which the Diaries were based, from Shodan.io.

Continue reading TriOp – tool for gathering (not just) security-related data from Shodan.io (tool drop), (Wed, Jan 27th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, January 27th, 2021 https://isc.sans.edu/podcastdetail.html?id=7346, (Wed, Jan 27th)→

Introduction

Continue reading TA551 (Shathak) Word docs push Qakbot (Qbot), (Tue, Jan 26th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, January 26th, 2021 https://isc.sans.edu/podcastdetail.html?id=7344, (Tue, Jan 26th)→

DOH (DNS over HTTPS) has been implemented into the various browsers over the last year or so, and there&#;x26;#;39;s a fair amount of support for it on public DNS services. Because it&#;x26;#;39;s encrypted and over TCP, the mantra of “because privacy” has carried the day it looks like. But why do network and system admins hate it so?

Continue reading Fun with NMAP NSE Scripts and DOH (DNS over HTTPS), (Mon, Jan 25th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, January 25th, 2021 https://isc.sans.edu/podcastdetail.html?id=7342, (Mon, Jan 25th)→

I made a video for my diary entry “Doc & RTF Malicious Document“. And I show a new feature of my tool re-search.py, that helps with filtering URLs found in OOXML files.

Continue reading Video: Doc & RTF Malicious Document, (Sun, Jan 24th)→

In diary entry “Doc & RTF Malicious Document” I start analyzing a malicious Word document with my tools.

Continue reading CyberChef: Analyzing OOXML Files for URLs, (Sat, Jan 23rd)→

When hunting, one thing that I like to learn is how attackers can be imaginative at deploying new techniques. I spotted some emails that had suspicious attachments based on the ‘.jnlp’ extension. I’m pretty sure that many people don’t know what’s their purpose and, if you don’t know them, you don’t have a look at them on your logs, SIEM, … That makes them a good candidate to deliver malicious code!

Continue reading Another File Extension to Block in your MTA: .jnlp, (Fri, Jan 22nd)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, January 22nd, 2021 https://isc.sans.edu/podcastdetail.html?id=7340, (Fri, Jan 22nd)→