Collaborate Disseminate
We received excellent comments and a question regarding cloud security features from an ISC reader today that we thought was important to share broadly. We&#;x26;#;39;d certainly like to open this up to reader comments, insights, and feedback.
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, May 5th 2020 https://isc.sans.edu/podcastdetail.html?id=6982, (Tue, May 5th)
A new version of Sysmon was released, with a new major feature: detection of file deletion (with deleted file preservation).
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, May 4th 2020 https://isc.sans.edu/podcastdetail.html?id=6980, (Mon, May 4th)
A comment on my diary entry “MALWARE Bazaar” mentioned problems with the ZIP password of downloaded samples (MALWARE Bazaar is a free service were you can download malware samples).
Taking a look with pdfid.py at a PDF received 2 days ago to update Amazon Prime account information:
Continue reading Phishing PDF with Unusual Hostname, (Sat, May 2nd)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, May 1st 2020 https://isc.sans.edu/podcastdetail.html?id=6978, (Fri, May 1st)
I don&#;x26;#;39;t know how many of you pay attention to the Top 10 Ports graphs on your isc.sans.edu dashboard, but I do. Unfortunately, the top 10 is pretty constant, the botnets are attacking the same ports. What I find more interesting is anomalous behavior. Changes from what is normal on a given port. So, a little over a week ago, I saw a jump on a port I wasn&#;x26;#;39;t familiar with.
Continue reading Attack traffic on TCP port 9673, (Fri, May 1st)
I&#;x26;#;39;ve plenty of subscriptions to “cyber security” mailing lists that generate a lot of traffic. Even if we try to get rid of emails, that&#;x26;#;39;s a fact: email remains a key communication channel. Some mailing lists posts contain interesting indicators of compromize. So, I searched for a nice way to extract them in an automated way (and to correlate them with other data). I did not find a solution ready to use that matched my requirements:
Continue reading Collecting IOCs from IMAP Folder, (Thu, Apr 30th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, April 30th 2020 https://isc.sans.edu/podcastdetail.html?id=6976, (Thu, Apr 30th)