Collaborate Disseminate
[Special Note: we will have a special webcast on this topic at noon ET tomorrow (Wednesday, January 15th. See https://sans.org/cryptoapi-isc )
Continue reading Microsoft Patch Tuesday for January 2020, (Tue, Jan 14th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, January 14th 2020 https://isc.sans.edu/podcastdetail.html?id=6822, (Tue, Jan 14th)
If you missed Johannes&#;x26;#;39; diary entry “Citrix ADC Exploits are Public and Heavily Used. Attempts to Install Backdoor” this Saturday, make sure to read it first.
Continue reading Citrix ADC Exploits: Overview of Observed Payloads, (Mon, Jan 13th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, January 13th 2020 https://isc.sans.edu/podcastdetail.html?id=6820, (Mon, Jan 13th)
In my last two diaries, I shared a Pihole parser and dashboard to collect and view its logs in Elastic. In this diary, I&#;x26;#;39;m sharing another parser and dashboard to visualize the data collected by Didier&#;x26;#;39;s tcp-honeypot. This is a work in progress.
Continue reading ELK Dashboard and Logstash parser for tcp-honeypot Logs, (Sun, Jan 12th)
IMPORTANT UPDATE: CITRIX announced that a patch will be released on January 20th for Citrix ADC 11/12 and 13. Version 10 will have to wait until January 31st. (https://support.citrix.com/article/CTX267027)
Yesterday, I posted a quick analysis of a malicious document that exfiltrates data from the compromised computer[1]. Here is another found that also exfiltrate data. The malware is delivered in an ACE archive. This file format remains common in phishing campaigns because the detection rate is lower at email gateways (many of them can’t handle the file format). The archive contains a PE file called ‘Payment Copy.exe’ (SHA256:88a6e2fd417d145b55125338b9f53ed3e16a6b27fae9a3042e187b5aa15d27aa). The payload is unknown on VT at this time.
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, January 10th 2020 https://isc.sans.edu/podcastdetail.html?id=6818, (Fri, Jan 10th)
Yesterday, one of our readers (thank David!) submitted to us a malicious document disguised as a UPS invoice. Like David, do not hesitate to share samples with us, we like malware samples! I briefly checked the document. Nothing new, based on a classic macro, it was easy to analyze and I can give you an overview of the infection process and what kind of data can be exfiltrated.
Continue reading Quick Analyzis of a(nother) Maldoc, (Thu, Jan 9th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, January 9th 2020 https://isc.sans.edu/podcastdetail.html?id=6816, (Thu, Jan 9th)