Collaborate Disseminate
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, December 27th 2019 https://isc.sans.edu/podcastdetail.html?id=6802, (Fri, Dec 27th)
First of all, Merry Christmas to all our readers&#;x26;#;x21; I hope you&#;x26;#;39;re enjoying the break with your family and friends&#;x26;#;x21; Even if everything slows down in this period, there is always malicious activity ongoing. I found a small PowerShell script that looked interesting for a quick diary. First of all, it has a VT score of 2/60[1]. It installs a cryptominer and its most interesting feature is the use of a classic technique to bypass UAC[2].
Continue reading Bypassing UAC to Install a Cryptominer, (Thu, Dec 26th)
We wish you and your families a merry christmas!
The acquisition of evidence is one of the procedures that always brings controversy in incident management. We must answer questions such as:
In diary entry “VBA Office Document: Which Version?“, I explain how to identify the Office version that was used to create a document with VBA macros.
Continue reading New oledump.py plugin: plugin_version_vba, (Mon, Dec 23rd)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, December 23rd 2019 https://isc.sans.edu/podcastdetail.html?id=6800, (Mon, Dec 23rd)
I updated my oledump.py tool to help with the analysis of files that embed OLE files, like AutoCAD&#;x26;#;39;s .dwg files with VBA macros.
Continue reading Extracting VBA Macros From .DWG Files, (Sun, Dec 22nd)
Wireshark version 3.2.0 was released, with many improvements.
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, December 20th 2019 https://isc.sans.edu/podcastdetail.html?id=6798, (Fri, Dec 20th)