Collaborate Disseminate
———–
Guy Bruneau IPSS Inc.
My Handler Page
Twitter: GuyBruneau
gbruneau at isc dot sans dot edu
We all run plenty of security tools on our endpoints. Their goal is to protect us by preventing infection (or trying to prevent it). But all those security tools are present on our devices like normal applications and are, therefore, easy to detect. Techniques to detect the presence of such security tools are multiple:
Continue reading Malicious Python Code and LittleSnitch Detection, (Fri, Nov 20th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, November 20th 2020 https://isc.sans.edu/podcastdetail.html?id=7262, (Fri, Nov 20th)
Here is an interesting PowerShell dropper&#;x26;#;xc2;&#;x26;#;xa0;that is nicely obfuscated and has anti-VM detection. I spotted this file yesterday, called &#;x26;#;39;ad.jpg&#;x26;#;39;&#;x26;#;xc2;&#;x26;#;xa0;(SHA256:b243e807ed22359a3940ab16539ba59910714f051034a8a155cc2aff28a85088). Of course, it&#;x26;#;39;s not a picture but a huge text file with Base64-encoded data. The VT score is therefore interesting: 0/61![1].&#;x26;#;xc2;&#;x26;#;xa0;Once decoded, we discover the obfuscated PowerShell code. Let&#;x26;#;39;s review the techniques implemented by the attacker.
Continue reading PowerShell Dropper Delivering Formbook, (Thu, Nov 19th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, November 19th 2020 https://isc.sans.edu/podcastdetail.html?id=7260, (Thu, Nov 19th)
The job of security professionals is to protect customers&#;x26;#;39; assets and, even more, today, customers&#;x26;#;39; data. The security landscape is full of solutions that help to improve security by detecting (and blocking) threats knocking on the organizations&#;x26;#;39; doors. Sometimes, such solutions have side effects that go to the opposite direction and make customers more vulnerable to attacks.
Continue reading When Security Controls Lead to Security Issues, (Wed, Nov 18th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, November 18th 2020 https://isc.sans.edu/podcastdetail.html?id=7258, (Wed, Nov 18th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, November 17th 2020 https://isc.sans.edu/podcastdetail.html?id=7256, (Tue, Nov 17th)
Since new critical vulnerabilities are discovered and published nearly every day, it is no wonder that we (i.e. security professionals and security-oriented media) tend to focus on these and don’t return to the ones that came before too often. Unless there is a massive exploitation campaign, that is. This doesn’t present any problems for organizations, which manage to patch vulnerabilities on time, but for many others the âhistoricalâ vulnerabilities, which are not talked about anymore, still pose clear and present danger.
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, November 16th 2020 https://isc.sans.edu/podcastdetail.html?id=7254, (Mon, Nov 16th)