Author Archives: SANS Internet Storm Center, InfoCON: green

Security, Orchestration, Automation and Response (SOAR) allow organizations to collect data about security threats from multiple sources to automate an appropriate response on repetitive tasks. As an analyst you need to juggle and pivot several times a day between multiple tools and devices to evaluate a huge amount information and deal with flood of repetitive tasks such as alerts, tickets, email, threat intelligence data, etc. The end goal is to centralize everything in one location to improve analysis using captured institutionalized knowledge.

Continue reading SOAR or not to SOAR?, (Sun, Feb 16th)→

Reading Xavier&#;x26;#;39;s diary entry “Keep an Eye on Command-Line Browsers”, I wondered when exactly curl was introduced in Windows 10?

Continue reading bsdtar on Windows 10, (Sat, Feb 15th)→

For a few weeks, I’m searching for suspicious files that make use of a command line browser like curl.exe or wget.exe in Windows environment. Wait, you were not aware of this? Just open a cmd.exe and type ‘curl.exe’ on your Windows 10 host:

Continue reading Keep an Eye on Command-Line Browsers, (Fri, Feb 14th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, February 14th 2020 https://isc.sans.edu/podcastdetail.html?id=6868, (Fri, Feb 14th)→

Good news, sort-of – – Microsoft has deferred their March changes to LDAP, citing the Christmas change freeze that most sensible organizations implement as their reason:

Continue reading Auth-mageddon deferred (but not averted), Microsoft LDAP Changes now slated for Q3Q4 2020, (Thu, Feb 13th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, February 13th 2020 https://isc.sans.edu/podcastdetail.html?id=6866, (Thu, Feb 13th)→

Next month Microsoft will be changing the default behaviour for LDAP – Cleartext, unsigned LDAP queries against AD (over port 389) will be disabled by default - https://support.microsoft.com/en-gb/help/4520412/2020-ldap-channel-binding-and-ldap-signing-requirement-for-windows  .  You'll still be able to over-ride that using registry keys or group policy, but the best advice is to configure all LDAP clients to use encrypted, signed LDAPS queries (over port 636).

Continue reading March Patch Tuesday is Coming – the LDAP Changes will Change Your Life!, (Wed, Feb 12th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, February 12th 2020 https://isc.sans.edu/podcastdetail.html?id=6864, (Wed, Feb 12th)→

Introduction

Continue reading Malpsam pushes Ursnif through Italian language Word docs, (Wed, Feb 12th)→

Continue reading Microsoft Patch Tuesday for February 2020, (Tue, Feb 11th)→