Author Archives: SANS Internet Storm Center, InfoCON: green

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, June 4th 2020 https://isc.sans.edu/podcastdetail.html?id=7024, (Thu, Jun 4th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, June 3rd 2020 https://isc.sans.edu/podcastdetail.html?id=7022, (Wed, Jun 3rd)→

Introduction

Continue reading Polish malspam pushes ZLoader malware, (Thu, Jun 4th)→

Update 1: Added disassembler output.

Continue reading Stackstrings, type 2, (Mon, Jun 1st)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, June 2nd 2020 https://isc.sans.edu/podcastdetail.html?id=7020, (Tue, Jun 2nd)→

XLMMacroDeobfuscator is an open-source tool to deobfuscate Excel 4 macros. I wrote diary entries about it here and here.

Continue reading XLMMacroDeobfuscator: An Update, (Mon, Jun 1st)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, June 1st 2020 https://isc.sans.edu/podcastdetail.html?id=7018, (Mon, Jun 1st)→

Microsoft released with the October 2018 Update a built-in packet sniffer for Windows 10 located in C:\Windows\system32\PktMon.exe. At ISC we like packets and this is one of the multiple ways to capture packets and send us a copy for analysis. Rob previously published another way of capturing packets in Windows here. If Windows 10 was compromised, this application would be a prime target by malicious actors and it need to be monitored, protected or removed in an enterprise.

Continue reading Windows 10 Built-in Packet Sniffer – PktMon, (Sun, May 31st)→

A couple of weeks ago, YARA 4.0.0. was released with support for BASE64 strings.

Continue reading YARA v4.0.1, (Sat, May 30th)→

Researchers have been using various tools to perform internet-wide scans for many years. Some will publish data continuously to either notify users of infected or misconfigured systems. Others will use the data to feed internal proprietary systems, or publish occasional research papers.

Continue reading The Impact of Researchers on Our Data, (Fri, May 29th)→