ISC Handler Series: SANS@MIC – Maldocs: a bit of blue, a bit of red, (Sun, Jun 21st)
This week, I presented at SANSFIRE: SANS@MIC – Maldocs: a bit of blue, a bit of red.
Author Archives: SANS Internet Storm Center, InfoCON: green
Pi Zero HoneyPot , (Sat, Jun 20th)
The ISC has had a Pi honeypot(1) for the last couple of years, but I haven&;&;#x23;39;t had much time to try it on the Pi zero. Recently, I&;&;#x23;39;ve had a chance to try it out, and it works great.
Sigma rules! The generic signature format for SIEM systems., (Fri, Jun 19th)
What Snort is to network traffic, and YARA to files, is Sigma to logs. By creating and using Sigma rules you’ll have generic rules which can be shared and run against different targets (e.g. SIEMs).
Continue reading Sigma rules! The generic signature format for SIEM systems., (Fri, Jun 19th)
ISC Stormcast For Friday, June 19th 2020 https://isc.sans.edu/podcastdetail.html?id=7046, (Fri, Jun 19th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, June 19th 2020 https://isc.sans.edu/podcastdetail.html?id=7046, (Fri, Jun 19th)
Broken phishing accidentally exploiting Outlook zero-day, (Thu, Jun 18th)
When we think of zero-days, what comes to mind are usually RCEs or other high-impact vulnerabilities. Zero-days, however, come in all shapes and sizes and many of them are low impact, as is the vulnerability we’re going to discuss today. What is interesting about it, apart from it allowing a sender of an e-mail to include/change a link in an e-mail when it is forwarded by Outlook, is that I noticed it being exploited in a low-quality phishing e-mail by what appears to be a complete accident.
Continue reading Broken phishing accidentally exploiting Outlook zero-day, (Thu, Jun 18th)
ISC Stormcast For Thursday, June 18th 2020 https://isc.sans.edu/podcastdetail.html?id=7044, (Thu, Jun 18th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, June 18th 2020 https://isc.sans.edu/podcastdetail.html?id=7044, (Thu, Jun 18th)
ISC Stormcast For Wednesday, June 17th 2020 https://isc.sans.edu/podcastdetail.html?id=7042, (Wed, Jun 17th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, June 17th 2020 https://isc.sans.edu/podcastdetail.html?id=7042, (Wed, Jun 17th)
Odd “Protest” Spam (Scam?) Targeting Atlanta Police Foundation, (Tue, Jun 16th)
After the killing of Rayshard Brooks by Atlanta police this week, a lot of protests and anger was directed at the Atlanta police department and its officers. Yesterday, we received an odd spam message, that may be targeting the Atlanta Police Foundation. The Atlanta Police Foundation is a not-for-profit organization collecting funding for various causes related to the Atlanta police. The Atlanta Police Foundation has been quoted in several news reports regarding the low morale of officers and officer resignation. It is no surprise that it is within scope for protests online.
Continue reading Odd “Protest” Spam (Scam?) Targeting Atlanta Police Foundation, (Tue, Jun 16th)
Sextortion to The Next Level, (Tue, Jun 16th)
For a long time, our mailboxes are flooded with emails from “hackers†(note the quotes) who pretend to have infected our computers with malware. The scenario is always the same: They successfully collected sensitive pieces of evidence about us (usually, men visiting adult websites) and request some money to be paid in Bitcoins or they will disclose everything. We already reported this kind of malicious activity for the first time in 2018[1]. Attacks evolved with time and they improved their communication by adding sensitive information like a real password (grabbed from major data leaks) or mobile phones.
Continue reading Sextortion to The Next Level, (Tue, Jun 16th)
ISC Stormcast For Tuesday, June 16th 2020 https://isc.sans.edu/podcastdetail.html?id=7040, (Tue, Jun 16th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, June 16th 2020 https://isc.sans.edu/podcastdetail.html?id=7040, (Tue, Jun 16th)