Author Archives: SANS Internet Storm Center, InfoCON: green
ISC Stormcast For Tuesday, September 10th 2019 https://isc.sans.edu/podcastdetail.html?id=6658, (Tue, Sep 10th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, September 10th 2019 https://isc.sans.edu/podcastdetail.html?id=6658, (Tue, Sep 10th)
ISC Stormcast For Monday, September 9th 2019 https://isc.sans.edu/podcastdetail.html?id=6656, (Mon, Sep 9th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, September 9th 2019 https://isc.sans.edu/podcastdetail.html?id=6656, (Mon, Sep 9th)
Unidentified Scanning Activity, (Sat, Sep 7th)
Over the two weeks, my honeypot has captured a new scan. According for the URL targeted and some research, this might be used to identify Dahua[1] or HiSilicon[2] digital video recorder (DVR) product. So for I have only seen this activity against port 80 and the scans for this activity looks like this:
Continue reading Unidentified Scanning Activity, (Sat, Sep 7th)
PowerShell Script with a builtin DLL, (Fri, Sep 6th)
Attackers are always trying to bypass antivirus detection by using new techniques to obfuscate their code. I recently found a bunch of scripts that encode part of their code in Base64. The code is decoded at execution time and processed via the &#;x26;#;39;IEX&#;x26;#;39; command:
Continue reading PowerShell Script with a builtin DLL, (Fri, Sep 6th)
ISC Stormcast For Friday, September 6th 2019 https://isc.sans.edu/podcastdetail.html?id=6654, (Fri, Sep 6th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, September 6th 2019 https://isc.sans.edu/podcastdetail.html?id=6654, (Fri, Sep 6th)
Private IP Addresses in Malware Samples?, (Thu, Sep 5th)
I&#;x26;#;39;m looking for some samples on VT that contains URLs with private or non-routable IP addresses (RFC1918)[1]. I found one recently and it made me curious. Why would a malware try to connect to a non-routable IP address?
Continue reading Private IP Addresses in Malware Samples?, (Thu, Sep 5th)
ISC Stormcast For Thursday, September 5th 2019 https://isc.sans.edu/podcastdetail.html?id=6652, (Thu, Sep 5th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, September 5th 2019 https://isc.sans.edu/podcastdetail.html?id=6652, (Thu, Sep 5th)
ISC Stormcast For Wednesday, September 4th 2019 https://isc.sans.edu/podcastdetail.html?id=6650, (Wed, Sep 4th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, September 4th 2019 https://isc.sans.edu/podcastdetail.html?id=6650, (Wed, Sep 4th)