Author Archives: SANS Internet Storm Center, InfoCON: green

One common pattern in password resets is sending a one-time password to the user to enable them to reset their password. The flow usually looks like:

Continue reading Hikvision Password Reset Brute Forcing, (Mon, Jan 13th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, January 13th, 2025 https://isc.sans.edu/podcastdetail/9276, (Mon, Jan 13th)→

VBA macros and embedded files/objects are stored as OLE files inside OOXML files.

Continue reading Multi-OLE, (Sun, Jan 12th)→

Wireshark release 4.4.3 fixes 0 vulnerabilities and 8 bugs.

Continue reading Wireshark 4.4.3 Released, (Sat, Jan 11th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, January 10th, 2025 https://isc.sans.edu/podcastdetail/9274, (Fri, Jan 10th)→

With the recent Cyberhaven Extension(2) attack, looking for specific Chrome extensions installed can be very helpful. If you are running Defender with enhanced vulnerability management, Defender automatically catalogs installed extensions by going to Vulnerability Management -> Inventories and selecting Browser Extension from the Defender Console. Also, you can do Hunt Queries on the DeviceTvmBrowserExtensions table.

Continue reading Windows Defender Chrome Extension Detection, (Fri, Jan 10th)→

[This is a Guest Diary by Cody Hales, an ISC intern as part of the SANS.edu BACS program]

Continue reading Examining Redtail Analyzing a Sophisticated Cryptomining Malware and its Advanced Tactics [Guest Diary], (Thu, Jan 9th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, January 9th, 2025 https://isc.sans.edu/podcastdetail/9272, (Thu, Jan 9th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, January 8th, 2025 https://isc.sans.edu/podcastdetail/9270, (Wed, Jan 8th)→

<!– wp:paragraph –>The SANS DShield project receives a wide variety of logs submitted by participants of the DShield project. Looking at the “” URLs page, I observed an interesting URL and dived deeper to investigate. The URL recorded is as follows:

Continue reading PacketCrypt Classic Cryptocurrency Miner on PHP Servers, (Tue, Jan 7th)→