Collaborate Disseminate
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, August 4th 2020 https://isc.sans.edu/podcastdetail.html?id=7108, (Tue, Aug 4th)
I spotted another interesting Powershell script. It&#;x26;#;39;s a bot and is delivered through a VBA macro that spawns an instance of msbuild.exe This Windows tool is often used to compile/execute malicious on the fly (I already wrote a diary about this technique[1]). I don’t have the original document but based on a technique used in the macro, it is part of a Word document. It calls Document_ContentControlOnEnter[2]:
Continue reading Powershell Bot with Multiple C2 Protocols, (Mon, Aug 3rd)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, August 3rd 2020 https://isc.sans.edu/podcastdetail.html?id=7106, (Mon, Aug 3rd)
A reader submitted malicious Word document deed contract,07.20.doc (also uploaded the Malware Bazaar).
Continue reading Small Challenge: A Simple Word Maldoc, (Sun, Aug 2nd)
I’ve been wondering for some time now about what pages and paths are visited the most by “bad†bots – scrapers, data harvesters and other automated scanners which disregards the exclusions set in robots.txt[1]. To determine this, I’ve set up a little experiment – I placed robots.txt on one of my domains, which disallowed access to commonly used paths and PHP pages which might of interest to bots (login.php, /wp-admin/, etc.), configured the server to provide HTTP 200 response for these paths and pages and started logging details about requests sent to them.
Continue reading What pages do bad bots look for?, (Sat, Aug 1st)
This diary started out as a frequency analysis of zone files for domains that expire before May 2023. Our intent was to look for frequency of random on all Generic Top-Level Domains (gTLDs). This exercise quickly turned into “create the freq file†for the analysis.
Continue reading Building a .freq file with Public Domain Data Sources, (Fri, Jul 31st)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, July 31st 2020 https://isc.sans.edu/podcastdetail.html?id=7104, (Fri, Jul 31st)
I know… tried it several times… growing up is hard. So instead, you decided to become a “Red Teamer” (aka Pentesters…). You got the hoodie, and you acquired a taste for highly caffeinated energy drinks. Now the only thing left: Learning to write a script. So like all the other “kids,” you learn Python and start writing and publishing tools (Yes… all the world needed was DNS covert channel tool #32773… you realize you could have written that as a bash oneliner?).
Continue reading Python Developers: Prepare!!!, (Thu, Jul 30th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, July 30th 2020 https://isc.sans.edu/podcastdetail.html?id=7102, (Thu, Jul 30th)
If you are watching YouTube videos, you may have noticed how many of them include sales pitches for various VPN providers. Here at the Internet Storm Center, we do regularly receive offers for paid articles, or requests for podcast pitches, from VPN providers or “VPN Review Guides”. VPNs have certainly become a new hot business.
Continue reading Consumer VPNs: You May Be Fine Without, (Wed, Jul 29th)