Collaborate Disseminate
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, December 7th 2020 https://isc.sans.edu/podcastdetail.html?id=7280, (Mon, Dec 7th)
My tool oledump uses indicators, you&#;x26;#;39;re probably most familiar with indicators M and m that indicate that a stream contains macros.
Continue reading oledump’s Indicators (video), (Sun, Dec 6th)
Scanning by IP 91.199.118.137 (first reported in DShield end September) began early this morning which appears to be testing access to site aahwwx.52host.xyz [2] and currently there is little information available for this host. The scan is alternating between ports TCP/81 and TCP/8088. Domaintools [7] shows the root domain 52host.xyz was last updated yesterday.
Continue reading Is IP 91.199.118.137 testing Access to aahwwx.52host.xyz?, (Sat, Dec 5th)
Over the past three weeks I have applied threat intel to all the inbound traffic going to my honeypot and the stats have shown some interesting trends. The top 20 TCP ports targeted have been between 1-50 and top 20 UDP 7-11211. During this period, the sensor recorded over 301K indicators matching threat intel from known actors.
Continue reading Detecting Actors Activity with Threat Intel, (Fri, Dec 4th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, December 4th 2020 https://isc.sans.edu/podcastdetail.html?id=7278, (Fri, Dec 4th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, December 3rd 2020 https://isc.sans.edu/podcastdetail.html?id=7276, (Thu, Dec 3rd)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, December 2nd 2020 https://isc.sans.edu/podcastdetail.html?id=7274, (Wed, Dec 2nd)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, December 1st 2020 https://isc.sans.edu/podcastdetail.html?id=7272, (Tue, Dec 1st)
PowerShell scripts are often used to deliver malicious payloads: shellcode, another PowerShell script, reflective DLL, â¦
Continue reading Decrypting PowerShell Payloads (video), (Mon, Nov 30th)