Collaborate Disseminate
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, April 17th 2020 https://isc.sans.edu/podcastdetail.html?id=6958, (Fri, Apr 17th)
STI student David Brown published an STI research paper in January with some interesting ideas to prevent living off the land attacks with AppLocker. Living off the land attacks use existing Windows binaries instead of downloading specific attack tools. This post-compromise technique is very difficult to block. AppLocker isn&#;x26;#;39;t really designed to block these attacks because AppLocker by default does allow standard Windows binaries to run.
Continue reading Using AppLocker to Prevent Living off the Land Attacks, (Thu, Apr 16th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, April 16th 2020 https://isc.sans.edu/podcastdetail.html?id=6956, (Thu, Apr 16th)
Most of us know that macros in Office documents are one of the most common ways to get malware into an organization.&#;x26;#;xc2;&#;x26;#;xa0; Unfortunately, all to many organizations depend on their AV products to detect these macros and the associated malware.&#;x26;#;xc2;&#;x26;#;xa0; It&#;x26;#;39;s sad fact that macro&#;x26;#;39;s are easy to write, and it&#;x26;#;39;s not too tough to evade AV by being smart about how you write a malicious macro.
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, April 15th 2020 https://isc.sans.edu/podcastdetail.html?id=6954, (Wed, Apr 15th)
This month we got patches for 113 vulnerabilities total. According to Microsoft, three of them are being exploited (CVE-2020-1020, CVE-2020-0938 and CVE-2020-0968) &#;x26;#;xc2;&#;x26;#;xa0;and two were previously disclosed (CVE-2020-1020 and CVE-2020-0935).
&#;x26;#;xd;
&#;x26;#;xd; Two of the exploited vulnerabilities (CVE-2020-1020 and CVE-2020-0938) are RCEs found by Google Project Zero in Adobe Font Manager Library. They exist in way the library improperly handles a specially-crafted multi-master font – Adobe Type 1 PostScript format. For all systems except Windows 10, an attacker who successfully exploited the vulnerabilities could execute code remotely. For systems running Windows 10, an attacker who successfully exploited the vulnerabilities could execute code in an AppContainer sandbox context with limited privileges and capabilities.
&#;x26;#;xd;
&#;x26;#;xd; The other exploited vulnerability (CVE-2020-0968) is remote code execution vulnerability in Internet Explorer. It consists in the way the scripting engine handles objects in memory. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user.&#;x26;#;xc2;&#;x26;#;xa0;
&#;x26;#;xd;
&#;x26;#;xd; The highest CVSS v3 score this month (8.80) was given to the vulnerability CVE-2020-0687. It is a RCE in Microsoft Graphics and exists due to the way the library improperly handles specially crafted embedded fonts. An attacker who successfully exploited the vulnerability could take control of the affected system.
&#;x26;#;xd;
&#;x26;#;xd; See Renato&#;x26;#;39;s dashboard for a more detailed breakout: https://patchtuesdaydashboard.com
&#;x26;#;xd; &#;x26;#;xc2;&#;x26;#;xa0;
&#;x26;#;xd; Continue reading Microsoft April 2020 Patch Tuesday, (Tue, Apr 14th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, April 14th 2020 https://isc.sans.edu/podcastdetail.html?id=6952, (Tue, Apr 14th)
While going through a batch of malicious e-mails, which were caught by my mail filters in March, I noticed a simple phishing e-mail, which carried an entire credential-stealing page in its attachment. This, although interesting in its own way, would not be that unusual[1,2]. While I was analyzing it, however, I found that a nearly identical e-mail message, which was obviously part of the same campaign, was uploaded to Any.Run[3] back in January. Since I had two samples from nearly 3 months apart, I thought it might be interesting to take a look at how much has changed in this phishing campaign over that time.
Continue reading Look at the same phishing campaign 3 months apart, (Mon, Apr 13th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, April 13th 2020 https://isc.sans.edu/podcastdetail.html?id=6950, (Mon, Apr 13th)
Reader Vinnie shared his analysis of KPOT malware with us: