Collaborate Disseminate
Over the past week, I have noticed several phishing emails linked to Salesforce asking to confirm the recipient’s email address.
Continue reading Analysis of a Salesforce Phishing Emails, (Sun, Sep 20th)
A few days ago, Didier wrote an interesting&#;x26;#;xc2;&#;x26;#;xa0;diary about embedded objects into an Office document&#;x26;#;x5b;1&#;x26;#;x5d;. I had a discussion about an interesting OLE file that I found. Because it used the same technique, I let Didier publish his diary first. Now, let&#;x26;#;39;s have a look at the document.
Continue reading A Mix of Python & VBA in a Malicious Word Document, (Fri, Sep 18th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, September 18th 2020 https://isc.sans.edu/podcastdetail.html?id=7172, (Fri, Sep 18th)
When a host is compromised/infected on your network, an important step in the Incident Handling process is the âcontainmentâ to prevent further infections. To place the device into a restricted environment is definitively better than powering off the system and, probably, lose some pieces of evidence.
Continue reading Suspicious Endpoint Containment with OSSEC, (Thu, Sep 17th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, September 17th 2020 https://isc.sans.edu/podcastdetail.html?id=7170, (Thu, Sep 17th)
We always say how network security is changing every day. Take a long lunch, and you may miss a critical exploit. But sometimes, time appears to stand still. We just passed 1.6 Billion seconds in the Unix Epoch. Back when the Unix timestamp still had 9 digits, in the late 90s also known as “pre Y2K”, one of the servers you may have used for backups was Amanda (Advanced Maryland Automatic Network Disk Archiver). Still active and alive today, back then Amanda V 2.3 was current.
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, September 16th 2020 https://isc.sans.edu/podcastdetail.html?id=7168, (Wed, Sep 16th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, September 15th 2020 https://isc.sans.edu/podcastdetail.html?id=7166, (Tue, Sep 15th)
More than 10 years ago, a first RFC was published describing the “.well-known” directory for web servers. The idea is pretty simple: Provide a standard location for files that are mostly intended for signaling and automatic retrieval. Before the introduction of .well-known, these files often ended up litering the document root, like for example robots.txt being probably the most popular example. Currently, .well-known is defined by RFC8615 [https://tools.ietf.org/html/rfc8615] .
Continue reading Not Everything About “.well-known” is Well Known, (Mon, Sep 14th)