Author Archives: SANS Internet Storm Center, InfoCON: green

My Little DoH Setup, (Mon, Nov 25th)

Posted on by

“DoH”&#;x26;#;x5b;1&#;x26;#;x5d;, this 3-letters acronym is a buzzword on the Internet in 2019&#;x26;#;x21; It has been implemented in Firefox, Microsoft announced that Windows will support it soon. They are pro &#;x26; con about encrypting&#;xc2;&#;xa0;DNS requests in&#;xc2;&#;xa0;&#;xc2;&#;xa0;HTTPS but it&#;x26;#;39;s not the goal of this diary to restart the debate. In a previous diary, he explained how to prevent DoH to be used by Firefox&#;x26;#;x5b;2&#;x26;#;x5d; but, this time, I&#;x26;#;39;ll play on the other side and explain to you how to implement it in a way to keep control of your DNS traffic (read: how to keep an eye on DNS request performed by users and systems). For a while, I had&#;xc2;&#;xa0;the idea to test a DoH configuration but I had some requirements:

Continue reading My Little DoH Setup, (Mon, Nov 25th)→

Posted in Uncategorized

Local Malware Analysis with Malice, (Sat, Nov 23rd)

Posted on by

This project (Malice) provides the ability to have your own locally managed multi-engine malware scanning system. The framework allows the owner to analyze files for known malware. It can be used both as a command tool to analyze samples and review the results via a Kibana web interface. The Command-Line Interface (CLI) is used to scan a file or directory or can be setup to watch and scan new files when copied into a write only directory.

Continue reading Local Malware Analysis with Malice, (Sat, Nov 23rd)→

Posted in Uncategorized

Abusing Web Filters Misconfiguration for Reconnaissance, (Fri, Nov 22nd)

Posted on by

Yesterday, an interesting incident&#;x26;#;xc2;&#;x26;#;xa0;was detected while working at a customer SOC. They use a &#;x26;#;xe2;&#;x26;#;x80;&#;x26;#;x9c;next-generation&#;x26;#;xe2;&#;x26;#;x80;&#;x26;#;x9d; firewall that implements a web filter based on categories. This is common in many organizations today: Users&#;x26;#;39;&#;x26;#;xc2;&#;x26;#;xa0;web traffic is allowed/denied&#;x26;#;xc2;&#;x26;#;xa0;based on an URL categorization database&#;x26;#;xc2;&#;x26;#;xa0;(like &#;x26;#;xe2;&#;x26;#;x80;&#;x26;#;x9c;adult content&#;x26;#;xe2;&#;x26;#;x80;&#;x26;#;x9d;, &#;x26;#;xe2;&#;x26;#;x80;&#;x26;#;x9c;hacking&#;x26;#;xe2;&#;x26;#;x80;&#;x26;#;x9d;, &#;x26;#;xe2;&#;x26;#;x80;&#;x26;#;x9c;gambling&#;x26;#;xe2;&#;x26;#;x80;&#;x26;#;x9d;, &#;x26;#;xe2;&#;x26;#;x80;¦). How was it detected?&#;x26;#;xc2;&#;x26;#;xa0;

Continue reading Abusing Web Filters Misconfiguration for Reconnaissance, (Fri, Nov 22nd)→

Posted in Uncategorized

Gathering information to determine unusual network traffic, (Thu, Nov 21st)

Posted on by

When working with threat intelligence, it&#39&#x3b;s vital to collect indicators of compromise to be able to determine possible attack patterns. What could be catalogued as unusual network traffic? This is all traffic that is not being seen normally in the network, meaning that after building a frequence table all IP addresses shown less than 1% are suspicious and should be investigated.

Continue reading Gathering information to determine unusual network traffic, (Thu, Nov 21st)→

Posted in Uncategorized