Author Archives: SANS Internet Storm Center, InfoCON: green

Don&#;x26;#;39;t misread, I won&#;x26;#;39;t talk about “lolcats” today but “LOLBins” or “Living Off The Land Binaries”. All operating systems provide a rich toolbox to achieve multiple day-to-day tasks like maintenance of the certificates, installation of patches and applications, management of files, and many more. Those tools are installed by default and available to all users without specific access rights (most of the time). Also very important, they are signed by the operating system so they are usually considered safe by default.

Continue reading Keep An Eye on LOLBins, (Tue, Aug 25th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, August 25th 2020 https://isc.sans.edu/podcastdetail.html?id=7138, (Tue, Aug 25th)→

During the weekend, I found several samples from the same VBA macro. The only difference between all the samples was the URL to fetch a malicious PE file. I have a specific YARA rule to search for embedded PowerShell strings and my rule fired several times with the same pattern and similar size. Here is the pattern:

Continue reading Tracking A Malware Campaign Through VT, (Mon, Aug 24th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, August 24th 2020 https://isc.sans.edu/podcastdetail.html?id=7136, (Mon, Aug 24th)→

I diary entry “Small Challenge: A Simple Word Maldoc – Part 2“, we used my tool numbers-to-string.py to convert and decode the numbers in malicious VBA macro code to a BAT command.

Continue reading Small Challenge: A Simple Word Maldoc – Part 4, (Sun, Aug 23rd)→

I&#;x26;#;39;m glad you asked. I&#;x26;#;39;m always interested in trends and reviewing the activity capture by my honeypot over this past week, it shows that no matter what port the RDP service is listening on, a specific RDP string (Cookie: mstshash=) might be sent to any ports to find out if it is listing for this service. Here are some examples:

Continue reading Remote Desktop (TCP/3389) and Telnet (TCP/23), What might they have in Common? , (Sat, Aug 22nd)→

———–
Guy Bruneau IPSS Inc.
My Handler Page
Twitter: GuyBruneau
gbruneau at isc dot sans dot edu

Continue reading VMware App Volumes patches address Stored Cross-Site Scripting (XSS) vulnerability – https://www.vmware.com/security/advisories/VMSA-2020-0019.html, (Sat, Aug 22nd)→

Continue reading A Word of Caution: Helping Out People Being Stalked Online, (Mon, Aug 3rd)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, August 21st 2020 https://isc.sans.edu/podcastdetail.html?id=7134, (Fri, Aug 21st)→

If you haven&#;x26;#;39;t heard, SANS suffered a “Data Incident” this summer, the disclosure was released on August 11. Details can be found in several locations:
This is well written up in several places:
https://www.sans.org/dataincident2020

Continue reading Office 365 Mail Forwarding Rules (and other Mail Rules too), (Thu, Aug 20th)→