Author Archives: SANS Internet Storm Center, InfoCON: green
Writing Yara Rules for Fun and Profit: Notes from the FireEye Breach Countermeasures, (Thu, Dec 10th)
By now, everyone should have seen that FireEye got breached and their red team tools got stolen. What is truly unique about their response is publishing detection rules&#;x26;#;xc2;&#;x26;#;xa0;to detect the use of those tools in the wild. However, the nature of some of those rules is that the detection will be short-lived. This isn&#;x26;#;39;t necessarily a fault of FireEye (as I will explain below) but it is useful as an exercise in writing Yara rules (or Snort, HXIOC, STIX, et al).
ISC Stormcast For Friday, December 11th 2020 https://isc.sans.edu/podcastdetail.html?id=7288, (Fri, Dec 11th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, December 11th 2020 https://isc.sans.edu/podcastdetail.html?id=7288, (Fri, Dec 11th)
Python Backdoor Talking to a C2 Through Ngrok, (Thu, Dec 10th)
I spotted a malicious Python script that implements a backdoor. The interesting behavior is the use of Ngrok to connect to the C2 server. Ngrok has been used for a while by attackers. Like most services available on the Internet, it has been abused by attackers for a long time. If you&#;x26;#;39;re not familiar with Ngrok[1], here is the principle: You download the Ngrok client and publish your services (ex: a web server) in the wild. Ngrok acts like a reverse-proxy and allows access to your published services. Because Ngrok is very popular, it&#;x26;#;39;s often not considered as harmful and is allowed to bypass firewalls, NAT, etc… By default, the host assigned to your published service is random but, if you create an account, you can force the host to be used (and use it in your malicious code). Example:
Continue reading Python Backdoor Talking to a C2 Through Ngrok, (Thu, Dec 10th)
ISC Stormcast For Thursday, December 10th 2020 https://isc.sans.edu/podcastdetail.html?id=7286, (Thu, Dec 10th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, December 10th 2020 https://isc.sans.edu/podcastdetail.html?id=7286, (Thu, Dec 10th)
Recent Qakbot (Qbot) activity, (Wed, Dec 9th)
ISC Stormcast For Wednesday, December 9th 2020 https://isc.sans.edu/podcastdetail.html?id=7284, (Wed, Dec 9th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, December 9th 2020 https://isc.sans.edu/podcastdetail.html?id=7284, (Wed, Dec 9th)
December 2020 Microsoft Patch Tuesday: Exchange, Sharepoint, Dynamics and DNS Spoofing, (Tue, Dec 8th)
December 2020 Microsoft Patch Tuesday: Exchange, Sharepoint, Dynamics, and DNS SpoofingFor the last Patch Tuesday of the year, Microsoft provided updates fixing 58 vulnerabilities, which is at the low end of what we have seen this year. 9 of the vulnerabilities are rated critical.
ISC Stormcast For Tuesday, December 8th 2020 https://isc.sans.edu/podcastdetail.html?id=7282, (Tue, Dec 8th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, December 8th 2020 https://isc.sans.edu/podcastdetail.html?id=7282, (Tue, Dec 8th)
Corrupt BASE64 Strings: Detection and Decoding, (Mon, Dec 7th)
My base64dump tool&#;x26;#;39;s goals are first to detect BASE64 encoded strings (and other encodings), and second to help with the decoding.
Continue reading Corrupt BASE64 Strings: Detection and Decoding, (Mon, Dec 7th)