Author Archives: SANS Internet Storm Center, InfoCON: green
Investigating Gaps in your Windows Event Logs, (Tue, Sep 17th)
I recently TA&#;x26;#;39;d the SANS SEC 504 class (Hacker Tools, Techniques, Exploits, and Incident Handling) , and one of the topics we covered was attackers “editing” windows event logs to cover their tracks, especially the Windows Security Event Log.
Continue reading Investigating Gaps in your Windows Event Logs, (Tue, Sep 17th)
ISC Stormcast For Tuesday, September 17th 2019 https://isc.sans.edu/podcastdetail.html?id=6668, (Tue, Sep 17th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, September 17th 2019 https://isc.sans.edu/podcastdetail.html?id=6668, (Tue, Sep 17th)
Encrypted Sextortion PDFs, (Mon, Sep 16th)
We&#;x26;#;39;ve written about sextortion emails several times. Reader Jason submitted another variant: password protected PDFs with a sextortion message (including QR code for the BTC address).
ISC Stormcast For Monday, September 16th 2019 https://isc.sans.edu/podcastdetail.html?id=6666, (Mon, Sep 16th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, September 16th 2019 https://isc.sans.edu/podcastdetail.html?id=6666, (Mon, Sep 16th)
Rig Exploit Kit Delivering VBScript, (Thu, Sep 12th)
I detected the following suspicious traffic on a corporate network. It was based on multiples infection stages and looked interesting enough to publish a diary about it. This is also a good reminder that, just by surfing the web, you can spot malicious scripts that will try to infect your computer (Exploit Kits).
Continue reading Rig Exploit Kit Delivering VBScript, (Thu, Sep 12th)
ISC Stormcast For Friday, September 13th 2019 https://isc.sans.edu/podcastdetail.html?id=6664, (Fri, Sep 13th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, September 13th 2019 https://isc.sans.edu/podcastdetail.html?id=6664, (Fri, Sep 13th)
Blocking Firefox DoH with Bind, (Thu, Sep 12th)
For a few days, huge debates have started on forums and mailing lists regarding the announce of Mozilla to enable DoH (DNS over HTTPS[1]) by default in its Firefox browser. Since this announcement, Google also scheduled a move to this technology with the upcoming Chrome releases (this has been covered in today’s podcast episode). My goal is not here to start a new debate. DoH has definitively good points regarding privacy but the problem is always the way it is implemented. In corporate environments, security teams will for sure try to avoid the use of DoH for logging reasons (DNS logs are a gold mine in incident management and forensics).
Continue reading Blocking Firefox DoH with Bind, (Thu, Sep 12th)
ISC Stormcast For Thursday, September 12th 2019 https://isc.sans.edu/podcastdetail.html?id=6662, (Thu, Sep 12th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, September 12th 2019 https://isc.sans.edu/podcastdetail.html?id=6662, (Thu, Sep 12th)
ISC Stormcast For Wednesday, September 11th 2019 https://isc.sans.edu/podcastdetail.html?id=6660, (Wed, Sep 11th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, September 11th 2019 https://isc.sans.edu/podcastdetail.html?id=6660, (Wed, Sep 11th)