SANS Internet Storm Center, InfoCON: green – Page 358

Setting up the Dshield honeypot and tcp-honeypot.py, (Wed, Jul 1st)

Posted on July 2, 2020 by SANS Internet Storm Center, InfoCON: green

After Johannes did his Tech Tuesday presentation last week on setting up Dshield honeypots, I thought I&#;x26;#;39;d walk you through how I setup my honeypots. I like to combine the Dshield honeypot with Didier Stevens&#;x26;#;39; tcp-honeypot so I can capture more suspicious traffic. Today, I&#;x26;#;39;ll walk you through my setup using a VM hosted by Digital Ocean, though the steps would work for pretty much any cloud provider.

Continue reading Setting up the Dshield honeypot and tcp-honeypot.py, (Wed, Jul 1st)→

Elastalert with Sigma, (Wed, Jul 1st)

Posted on July 1, 2020 by SANS Internet Storm Center, InfoCON: green

Continue reading Elastalert with Sigma, (Wed, Jul 1st)→

ISC Stormcast For Wednesday, July 1st 2020 https://isc.sans.edu/podcastdetail.html?id=7062, (Wed, Jul 1st)

Posted on July 1, 2020 by SANS Internet Storm Center, InfoCON: green

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, July 1st 2020 https://isc.sans.edu/podcastdetail.html?id=7062, (Wed, Jul 1st)→

ISC Snapshot: SpectX IP Hitcount Query, (Tue, Jun 30th)

Posted on June 30, 2020 by SANS Internet Storm Center, InfoCON: green

SpectX was the subject of an ISC post on SpectX4DFIR back in late April. Raido from SpectX provides us with a query to count hits from IPs during different time intervals.

Continue reading ISC Snapshot: SpectX IP Hitcount Query, (Tue, Jun 30th)→

ISC Stormcast For Tuesday, June 30th 2020 https://isc.sans.edu/podcastdetail.html?id=7060, (Tue, Jun 30th)

Posted on June 30, 2020 by SANS Internet Storm Center, InfoCON: green

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, June 30th 2020 https://isc.sans.edu/podcastdetail.html?id=7060, (Tue, Jun 30th)→

Sysmon and Alternate Data Streams, (Mon, Jun 29th)

Posted on June 29, 2020 by SANS Internet Storm Center, InfoCON: green

Sysmon version 11.10, released a couple of days ago, adds support for capturing content of Alternate Data Streams.

Continue reading Sysmon and Alternate Data Streams, (Mon, Jun 29th)→

ISC Stormcast For Monday, June 29th 2020 https://isc.sans.edu/podcastdetail.html?id=7058, (Mon, Jun 29th)

Posted on June 29, 2020 by SANS Internet Storm Center, InfoCON: green

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, June 29th 2020 https://isc.sans.edu/podcastdetail.html?id=7058, (Mon, Jun 29th)→

tcp-honeypot.py Logstash Parser & Dashboard Update, (Sun, Jun 28th)

Posted on June 28, 2020 by SANS Internet Storm Center, InfoCON: green

This is an update for logstash and dashboard published in January for Didier&#;x26;#;39;s tcp-honeypot.py honeypot script. The parser has been updated to follow the Elastic Common Schema (ECE) format, parsing more information from the honeypot logs that include revised and additional dashboards.

Continue reading tcp-honeypot.py Logstash Parser & Dashboard Update, (Sun, Jun 28th)→