Author Archives: SANS Internet Storm Center, InfoCON: green

A reader has been reporting an increase in scans for “FPURL.xml” against their IIS server. The file did not exist in this case, and the server returned a 404 error. Checking our honeypots, we found little to no requests for this URL. But our honeypots are currently not emulating IIS servers. These scans have been hitting IIS servers for a while, according to some other reports I found.

Continue reading Scans for FPURL.xml: Reconnaissance or Not?, (Wed, Sep 30th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, September 30th 2020 https://isc.sans.edu/podcastdetail.html?id=7188, (Wed, Sep 30th)→

Yesterday, I wrote a quick diary about a potential security issue that some Tyler customers faced[1]. Some people reacted to my diary with interesting comments in our forums. Two of them were interesting and deserve some review.

Continue reading Managing Remote Access for Partners & Contractors, (Tue, Sep 29th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, September 29th 2020 https://isc.sans.edu/podcastdetail.html?id=7186, (Tue, Sep 29th)→

When you need to perform malicious actions on a victim&#;x26;#;39;s computer, the Internet is full of resources that can be reused, forked, slightly changed to meet your requirements. After all, why reinvent the wheel if some pieces of code are available on GitHub for free? If you developed some offensive tools for good reasons (because you&#;x26;#;39;re a pentester, a red teamer of just doing some research), chances are high that your code will be reused.

Continue reading PowerShell Backdoor Launched from a ShellCode, (Mon, Sep 28th)→

One of our readers,&#;x26;#;xc2;&#;x26;#;xa0;a&#;x26;#;xc2;&#;x26;#;xa0;Tyler Technologies&#;x26;#;39;s customer,&#;x26;#;xc2;&#;x26;#;xa0;reported to us that he found this morning the&#;x26;#;xc2;&#;x26;#;xa0;Bomgar client[1] (BeyondTrust) installed on one of his servers. There is an ongoing discussion on&#;x26;#;xc2;&#;x26;#;xa0;Reddit&#;x26;#;xc2;&#;x26;#;xa0;with the same kind of reports[2].

Continue reading Some Tyler Technologies Customers Targeted with The Installation of a Bomgar Client, (Mon, Sep 28th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, September 28th 2020 https://isc.sans.edu/podcastdetail.html?id=7184, (Mon, Sep 28th)→

I was asked to help with the decoding of a BASE64 string that my base64dump.py tool could not handle.

Continue reading Decoding Corrupt BASE64 Strings, (Sun, Sep 27th)→

Wireshark version 3.2.7 was released.

Continue reading Wireshark 3.2.7 Released, (Sun, Sep 27th)→

[This is a guest diary by Jason Dance]

Continue reading Securing Exchange Online [Guest Diary], (Fri, Sep 25th)→