Author Archives: SANS Internet Storm Center, InfoCON: green

Two days ago, I wrote about how to profile traffic to recognize DNS over HTTPS. This is kind of a problem for DNS over HTTPS. If you can see it, you may be able to block it. On Twitter, a few chimed in to provide feedback about recognizing DNS over HTTPS. I checked a couple of other clients, and well, didn&#;x26;#;39;t have a ton of time so this is still very preliminary:

Continue reading More DNS over HTTPS: Become One With the Packet. Be the Query. See the Query, (Thu, Dec 19th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, December 19th 2019 https://isc.sans.edu/podcastdetail.html?id=6796, (Thu, Dec 19th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, December 18th 2019 https://isc.sans.edu/podcastdetail.html?id=6794, (Wed, Dec 18th)→

Introduction

Continue reading Emotet infection with spambot activity, (Wed, Dec 18th)→

Whenever I talk about DNS over HTTPS (DoH), the question comes up if it is possible to fingerprint DoH traffic without decrypting it. The idea is that something about DoH packets is different enough to identify them.

Continue reading Is it Possible to Identify DNS over HTTPs Without Decrypting TLS?, (Tue, Dec 17th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, December 17th 2019 https://isc.sans.edu/podcastdetail.html?id=6792, (Tue, Dec 17th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, December 16th 2019 https://isc.sans.edu/podcastdetail.html?id=6790, (Mon, Dec 16th)→

This weekend, I took a look at AutoCAD drawing files (.dwg) with embedded VBA macros.

Continue reading Malicious .DWG Files?, (Mon, Dec 16th)→

I think it&#;x26;#;39;s a good idea to highlight VirusTotal&#;x26;#;39;s Email Submission feature, as I recently had to point this out to a couple of people.

Continue reading VirusTotal Email Submissions, (Sun, Dec 15th)→

At the end of my diary entry “(Lazy) Sunday Maldoc Analysis“, I wrote that there was something unusal about this document.

Continue reading (Lazy) Sunday Maldoc Analysis: A Bit More …, (Sat, Dec 14th)→