Finding The Original Maldoc, (Mon, Aug 31st)
Xavier wrote about a “Malicious Excel Sheet with a NULL VT Score” and I showed how to extract the VBA code from the maldoc cleaned by AV.
Continue reading Finding The Original Maldoc, (Mon, Aug 31st)
Author Archives: SANS Internet Storm Center, InfoCON: green
ISC Stormcast For Monday, August 31st 2020 https://isc.sans.edu/podcastdetail.html?id=7146, (Mon, Aug 31st)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, August 31st 2020 https://isc.sans.edu/podcastdetail.html?id=7146, (Mon, Aug 31st)
CenturyLink Outage Causing Internet Wide Problems, (Sun, Aug 30th)
Update From Centrylink at approx 15:00 UTC / 11:00 EDST:
The IP NOC with the assistance of the Operations Engineering team confirmed a routing issue to be preventing BGP sessions from establishing correctly. A configuration adjustment was deployed at a high level, and sessions began to re-establish with stability. As the change propagates through the affected devices, service affecting alarms continue to clear.
Continue reading CenturyLink Outage Causing Internet Wide Problems, (Sun, Aug 30th)
Malicious Excel Sheet with a NULL VT Score: More Info, (Sat, Aug 29th)
The maldoc Xavier mentioned in diary entry “Malicious Excel Sheet with a NULL VT Score” is indeed corrupt, and that explains its low score on VT. I believe this maldoc has been cleaned by an anti-virus program: (incomplete) deletion of VBA modules.
Continue reading Malicious Excel Sheet with a NULL VT Score: More Info, (Sat, Aug 29th)
Example of Malicious DLL Injected in PowerShell, (Fri, Aug 28th)
For a while, PowerShell remains one of the favorite languages for attackers. Installed by default (and almost impossible to get rid of it), powerful, perfectly integrated with the core operating system. It&#;x26;#;39;s very easy to develop specific PowerShell functions that will provide interesting features for an attacker but, if written in PowerShell, they could easily ring a bell for the defenders (example: by using many suspicious API calls). Another technique to expand the language with more functions is just to load a DLL! I found a sample that exfiltrates data from the victim&#;x26;#;39;s computer.
Continue reading Example of Malicious DLL Injected in PowerShell, (Fri, Aug 28th)
ISC Stormcast For Friday, August 28th 2020 https://isc.sans.edu/podcastdetail.html?id=7144, (Fri, Aug 28th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, August 28th 2020 https://isc.sans.edu/podcastdetail.html?id=7144, (Fri, Aug 28th)
Security.txt – one small file for an admin, one giant help to a security researcher, (Thu, Aug 27th)
During the last few months, I’ve noticed a significant increase in the number of vulnerability reports for domains registered to some of our customers. I would guess that this increase probably stems from more time being devoted by bug bounty hunters and security researchers to finding vulnerabilities due to their Covid-19 related self-isolation. Whatever the cause is however, the increased number of reports is probably felt by many organizations around the world.
ISC Stormcast For Thursday, August 27th 2020 https://isc.sans.edu/podcastdetail.html?id=7142, (Thu, Aug 27th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, August 27th 2020 https://isc.sans.edu/podcastdetail.html?id=7142, (Thu, Aug 27th)
Malicious Excel Sheet with a NULL VT Score, (Wed, Aug 26th)
Just a quick diary today to demonstrate, once again, that relying only on a classic antivirus solution is not sufficient in 2020. I found a&#;x26;#;xc2;&#;x26;#;xa0;sample&#;x26;#;xc2;&#;x26;#;xa0;that just has&#;x26;#;xc2;&#;x26;#;xa0;a very nice score of 0/57 on VT. Yes, according to all AV&#;x26;#;39;s the file is safe. Really? If it matched one of my hunting rules, there is for sure something suspicious inside. Let&#;x26;#;39;s have a look at it.
Continue reading Malicious Excel Sheet with a NULL VT Score, (Wed, Aug 26th)
ISC Stormcast For Wednesday, August 26th 2020 https://isc.sans.edu/podcastdetail.html?id=7140, (Wed, Aug 26th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, August 26th 2020 https://isc.sans.edu/podcastdetail.html?id=7140, (Wed, Aug 26th)