Collaborate Disseminate
Hello Readers! The first day of the hack.lu conference is already over, here is my wrap-up! The event started around 10:30, plenty of time to meet friends around a first coffee! The conference was kicked off by Axelle Apvrille who is a security researcher focusing on mobile devices and apps.
[The post Hack.lu 2019 Day #1 Wrap-Up has been first published on /dev/random]
I’m in Luxembourg for a full week of infosec events. It started today with the MISP summit. It was already the fifth edition and, based on the number of attendees, the tool is getting more and more popularity. The event started with a recap of what happened since the last
[The post MISP Summit 0x05 Wrap-Up has been first published on /dev/random]
I published the following diary on isc.sans.edu: “Quick Malicious VBS Analysis“: Let’s have a look at a VBS sample found yesterday. It started as usual with a phishing email that contained a link to a malicious ZIP archive. This technique is more and more common to deliver the first stage via
[The post [SANS ISC] Quick Malicious VBS Analysis has been first published on /dev/random]
I published the following diary on isc.sans.edu: “Security Monitoring: At Network or Host Level?“: Today, to reach a decent security maturity, the keyword remains “visibility”. There is nothing more frustrating than being blind about what’s happening on a network or starting an investigation without any data (logs, events) to process.
[The post [SANS ISC] Security Monitoring: At Network or Host Level? has been first published on /dev/random]
Continue reading [SANS ISC] Security Monitoring: At Network or Host Level?
This BruCON edition (also called “0x0B”) is already over! This year, we welcomed more than 500 hackers from many countries to follow wonderful speakers and learn new stuff with practical workshops. Like the previous editions, I played with the network deployed for our attendees. Here is a short debriefing of
[The post BruCON 0x0B Network Post-Mortem Review has been first published on /dev/random]
I published the following diary on isc.sans.edu: ““Lost_Files” Ransomware“: Are good old malware still used by attackers today? Probably not running the original code but malware developers are… developers! They don’t reinvent the wheel and re-use code published here and there. I spotted a ransomware which looked like an old one… [Read
[The post [SANS ISC] “Lost_Files” Ransomware has been first published on /dev/random]
I published the following diary on isc.sans.edu: “Huge Amount of remotewebaccess.com Sites Found in Certificate Transparency Logs“: I’m keeping an eye on the certificate transparency logs using automated scripts. The goal is to track domain names (and their variations) of my customers, sensitive services in Belgium, key Internet players and some
[The post [SANS ISC] Huge Amount of remotewebaccess.com Sites Found in Certificate Transparency Logs has been first published on /dev/random]
I published the following diary on isc.sans.edu: “Agent Tesla Trojan Abusing Corporate Email Accounts“: The trojan ‘Agent Tesla’ is not brand new, discovered in 2018, it is written in VisualBasic and has plenty of interesting features. Just have a look at the MITRE ATT&CK overview of its TTP. I found a
[The post [SANS ISC] Agent Tesla Trojan Abusing Corporate Email Accounts has been first published on /dev/random]
Continue reading [SANS ISC] Agent Tesla Trojan Abusing Corporate Email Accounts
I published the following diary on isc.sans.edu: “Rig Exploit Kit Delivering VBScript“: I detected the following suspicious traffic on a corporate network. It was based on multiples infection stages and looked interesting enough to publish a diary about it. This is also a good reminder that, just by surfing the
[The post [SANS ISC] Rig Exploit Kit Delivering VBScript has been first published on /dev/random]
Continue reading [SANS ISC] Rig Exploit Kit Delivering VBScript
I published the following diary on isc.sans.edu: “Blocking Firefox DoH with Bind“: For a few days, huge debates have started on forums and mailing lists regarding the announce of Mozilla to enable DoH (DNS over HTTPS) by default in its Firefox browser. Since this announcement, Google also scheduled a move
[The post [SANS ISC] Blocking Firefox DoH with Bind has been first published on /dev/random]