Collaborate Disseminate
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, January 3rd 2020 https://isc.sans.edu/podcastdetail.html?id=6808, (Fri, Jan 3rd)
Happy new year to all! I hope that you enjoyed the switch to 2020! From a security point of view, nothing changed and malicious code never stops trying to abuse our resources even during the holiday season. Here is a sample that I spotted two days ago. It’s an interesting one because it’s a malware that implements ransomware features developed in Node.js[1]! The stage one is not obfuscated and I suspect the script to be a prototype or a test… It has been submitted to VT from Bahrein (SHA256:90acae3f682f01864e49c756bc9d46f153fcc4a7e703fd1723a8aa7ec01b378c) and has currently a score of 12/58[2].
“Nim httpclient/1.0.4” is the default User Agent string of the httpClient module of the Nim programming language (stable release).
[a recording of our special webcast will be available soon. [Download PPT Files]]
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, December 31st 2019 https://isc.sans.edu/podcastdetail.html?id=6806, (Tue, Dec 31st)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, December 30th 2019 https://isc.sans.edu/podcastdetail.html?id=6804, (Mon, Dec 30th)
Much of the data offered by us is available via our API [1]. A popular feature of our API is our “threat feeds.” We use them to distribute lists of IP addresses and hostnames that you may want to block. In particular, our feeds of mining pool IPs and hosts used by Shodan are popular. This weekend, I added a feed for Onyphe [2]. Onyphe is comparable to Shodan, and I do see a lot of scans from them lately, which is why I added the feed. While I was messing with the API, I also added the ability to retrieve hostnames in addition to IP addresses.
Continue reading Miscellaneous Updates to our “Threatfeed” API, (Mon, Dec 30th)
In my last Pihole Diary, I shared a Pihole parser to collect its logs and stored them into Elastic. In this diary, I&#;x26;#;39;m sharing a dashboard to visualize the Pihole DNS data. Here are some of the output from the dashboard.
Continue reading ELK Dashboard for Pihole Logs, (Sun, Dec 29th)
My tool to analyze CFBF files, oledump.py, is not only used to analyze malicious Office documents.
I found a pretty strange request in a University Firewall being sent over and over:
Continue reading Enumerating office365 users, (Fri, Dec 27th)