Author Archives: SANS Internet Storm Center, InfoCON: green

On Friday, I received a bunch of alerts from one of my YARA hunting rules. Several samples were submitted from the same account (through the VT API), from the same country (US), and in a very short period of time. All the submitted files were OLE2 files containing a malicious macro. All of them had a low VT score so it deserved some investigations. I downloaded the samples and had a look at them.

Continue reading How Attackers Brush Up Their Malicious Scripts, (Mon, Nov 9th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, November 9th 2020 https://isc.sans.edu/podcastdetail.html?id=7244, (Mon, Nov 9th)→

“How can I extract all VBA code with oledump from this malicious Word document?”.

Continue reading Quick Tip: Extracting all VBA Code from a Maldoc, (Sun, Nov 8th)→

This past week got some interesting logs targeting TCP/7001 (WebLogic CVE-2020-14882 – see previous diary[1][2]) looking to download and launch a shell script to install various cryptominer on the target. The shell script target SELINUX compatible hosts likely CentOS/RedHat, Ubuntu, etc to install various cryptominer applications.

Continue reading Cryptojacking Targeting WebLogic TCP/7001, (Sat, Nov 7th)→

[This is a guest diary by Yee Ching Tok. Feedback welcome either via comments or our contact page]

Continue reading Rediscovering Limitations of Stateful Firewalls: “NAT Slipstreaming” ? Implications, Detections and Mitigations , (Fri, Nov 6th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, November 6th 2020 https://isc.sans.edu/podcastdetail.html?id=7242, (Fri, Nov 6th)→

When a PowerShell script is obfuscated, the deobfuscation process is, most of the time, performed through the Invoke-Expression cmdlet[1]. Invoke-Expression evaluates the string passed as an argument and returns the results of the commands inside the string. Example:

Continue reading Did You Spot “Invoke-Expression”?, (Thu, Nov 5th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, November 5th 2020 https://isc.sans.edu/podcastdetail.html?id=7240, (Thu, Nov 5th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, November 4th 2020 https://isc.sans.edu/podcastdetail.html?id=7238, (Wed, Nov 4th)→

Starting late last week, we observed a large number of scans against our WebLogic honeypots to detect if they are vulnerable to CVE-2020-14882. CVE-2020-14882 was patched about two weeks ago as part of Oracle&#39&#x3b;s quarterly critical patch update. In addition to scans simply enumerating vulnerable servers, we saw a small number of scans starting on Friday (Oct. 30th) attempting to install crypto-mining tools [1].

Continue reading Attackers Exploiting WebLogic Servers via CVE-2020-14882 to install Cobalt Strike, (Tue, Nov 3rd)→