Author Archives: SANS Internet Storm Center, InfoCON: green

Today, it’s easy to guess if a piece of code is malicious or not. Many security solutions automatically detonate it into a sandbox by security solutions. This remains quick and (most of the time still) efficient to have a first idea about the code behaviour. In parallel, many obfuscation techniques exist to avoid detection by AV products and/or make the life of malware analysts more difficult. Personally, I like to find new techniques and discover how imaginative malware developers can be to implement new obfuscation techniques.

Continue reading Simple but Efficient VBScript Obfuscation, (Sat, Feb 22nd)→

We like when our readers share interesting samples! Even if we have our own sources to hunt for malicious content, it’s always interesting to get fresh meat from third parties. Robert shared an interesting Microsoft Word document that I quickly analysed. Thanks to him!

Continue reading Quick Analysis of an Encrypted Compound Document Format, (Fri, Feb 21st)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, February 21st 2020 https://isc.sans.edu/podcastdetail.html?id=6878, (Fri, Feb 21st)→

Eventually in almost every incident response situation, you have to start contacting the actual people who sit at the keyboard of affected stations.&#;x26;#;xc2;&#;x26;#;xa0; Often you&#;x26;#;39;ll want them to step back from the keyboard or logout, for either remote forensics data collection or for remediation.&#;x26;#;xc2;&#;x26;#;xa0; Or in the worst case, if you don&#;x26;#;39;t have remote re-imaging working in your shop, to either ship their station back to home base for re-imaging or to arrange a local resource to re-image the machien the hard way.

Continue reading Whodat? Enumerating Who “owns” a Workstation for IR, (Thu, Feb 20th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, February 20th 2020 https://isc.sans.edu/podcastdetail.html?id=6876, (Thu, Feb 20th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, February 19th 2020 https://isc.sans.edu/podcastdetail.html?id=6874, (Wed, Feb 19th)→

I recently noticed an interesting side effect of the way in which Windows handles local file permissions, which makes it possible for a non-privileged user to brute-force contents of a folder for which they don’t have read access (e.g. Read or List folder contents) permissions. It is possible that it is a known technique, however as I didn’t find any write-ups on it anywhere, I thought Iɽ share it here.

Continue reading Discovering contents of folders in Windows without permissions, (Tue, Feb 18th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, February 18th 2020 https://isc.sans.edu/podcastdetail.html?id=6872, (Tue, Feb 18th)→

There&#;x26;#;39;s an interesting comment on Xavier&#;x26;#;39;s diary entry “Keep an Eye on Command-Line Browsers” (paraphrasing): a proxy with authentication will prevent wget and curl to access the Internet because they don&#;x26;#;39;t do integrated authentication.

Continue reading curl and SSPI, (Mon, Feb 17th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, February 17th 2020 https://isc.sans.edu/podcastdetail.html?id=6870, (Mon, Feb 17th)→