Collaborate Disseminate
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, September 25th 2020 https://isc.sans.edu/podcastdetail.html?id=7182, (Fri, Sep 25th)
Today, I would like to talk about PowerShell ISE or&#;x26;#;xc2;&#;x26;#;xa0;”Integration Scripting Environment”&#;x26;#;x5b;1&#;x26;#;x5d;. This tool&#;x26;#;xc2;&#;x26;#;xa0;is installed by default on all Windows computers (besides the classic PowerShell interpreter). From a malware analysis point of view, ISE offers a key feature: an interactive debugger&#;x26;#;x21; It&#;x26;#;xc2;&#;x26;#;xa0;provides all the classic features that you can expect from a debugger: breakpoints, step in, step over, step out, … all of these features are available while you keep control of the environment to interact with the script through the help of&#;x26;#;xc2;&#;x26;#;xa0;other PowerShell commands. When you&#;x26;#;39;re facing a strongly obfuscated scripts, you could speed up the analysis with the help of carefully placed breakpoints.&#;x26;#;xc2;&#;x26;#;xa0;Let&#;x26;#;39;s have a look at a practical example.
Continue reading Party in Ibiza with PowerShell, (Thu, Sep 24th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, September 24th 2020 https://isc.sans.edu/podcastdetail.html?id=7180, (Thu, Sep 24th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, September 23rd 2020 https://isc.sans.edu/podcastdetail.html?id=7178, (Wed, Sep 23rd)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, September 22nd 2020 https://isc.sans.edu/podcastdetail.html?id=7176, (Tue, Sep 22nd)
At the Internet Storm Center, we often receive examples of interesting phishing e-mails from our readers. Of course, this is not the only source of interesting malicious messages in our inboxes â sometimes the phishing authors âcut out the middlemanâ and send their creations directly to us. Last week, this was the case with a slightly unusual (and slightly broken) phishing, which tries to use legitimate pages overlaid with a fake login prompt.
Continue reading Slightly broken overlay phishing, (Mon, Sep 21st)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, September 21st 2020 https://isc.sans.edu/podcastdetail.html?id=7174, (Mon, Sep 21st)
Over the past week, I have noticed several phishing emails linked to Salesforce asking to confirm the recipient’s email address.
Continue reading Analysis of a Salesforce Phishing Emails, (Sun, Sep 20th)
A few days ago, Didier wrote an interesting&#;x26;#;xc2;&#;x26;#;xa0;diary about embedded objects into an Office document&#;x26;#;x5b;1&#;x26;#;x5d;. I had a discussion about an interesting OLE file that I found. Because it used the same technique, I let Didier publish his diary first. Now, let&#;x26;#;39;s have a look at the document.
Continue reading A Mix of Python & VBA in a Malicious Word Document, (Fri, Sep 18th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, September 18th 2020 https://isc.sans.edu/podcastdetail.html?id=7172, (Fri, Sep 18th)