Collaborate Disseminate
After the 2018 DeepSec edition in November and the BruCON Spring Training in April, I’m happy to come back on the DeepSec 2019 schedule! OSSEC is sometimes described as a low-cost log management solution but it has many interesting features which, when combined with external sources of information, may help
[The post Training Announce: “Hunting with OSSEC” has been first published on /dev/random]
Last Tuesday, I launched a small challenge to win a ticket for the BruCON conference. The challenge was solved in approximatively 20:30 and I received the first correct submission of the hash at 23:30 (congratulations to Quentin Kaiser!). It’s time to give you the solution to this small challenge. It
[The post BruCON Challenge: The Solution has been first published on /dev/random]
I published the following diary on isc.sans.edu: “PowerShell Script with a builtin DLL“: Attackers are always trying to bypass antivirus detection by using new techniques to obfuscate their code. I recently found a bunch of scripts that encode part of their code in Base64. The code is decoded at execution
[The post [SANS ISC] PowerShell Script with a builtin DLL has been first published on /dev/random]
Continue reading [SANS ISC] PowerShell Script with a builtin DLL
I published the following diary on isc.sans.edu: “Private IP Addresses in Malware Samples?“: I’m looking for some samples on VT that contains URLs with private or non-routable IP addresses (RFC1918). I found one recently and it made me curious. Why would a malware try to connect to a non-routable IP
[The post [SANS ISC] Private IP Addresses in Malware Samples? has been first published on /dev/random]
Continue reading [SANS ISC] Private IP Addresses in Malware Samples?
The Belgian security conference BruCON 0x0B is already scheduled in a few weeks! The event becomes more and more popular and we were sold-out very quickly. If you don’t have a ticket, it’s too late! Well, not really. We have alternatives: Buy a training ticket and access to the 2-days
[The post BruCON Challenge: Solve & Win Your Ticket! has been first published on /dev/random]
I published the following diary on isc.sans.edu: “Malware Dropping a Local Node.js Instance“:
Yesterday, I wrote a diary about misused Microsoft tools[1]. I just found another interesting piece of code. This time the malware is using No… Continue reading [SANS ISC] Malware Dropping a Local Node.js Instance
I published the following diary on isc.sans.edu: “Malware Samples Compiling Their Next Stage on Premise“: I would like to cover today two different malware samples I spotted two days ago. They have one interesting behaviour in common: they compile their next stage on the fly directly on the victim’s computer. At
[The post [SANS ISC] Malware Samples Compiling Their Next Stage on Premise has been first published on /dev/random]
Continue reading [SANS ISC] Malware Samples Compiling Their Next Stage on Premise
I published the following diary on isc.sans.edu: “Simple Mimikatz & RDPWrapper Dropper“: Let’s review a malware sample that I spotted a few days ago. I found it interesting because it’s not using deep techniques to infect its victims. The initial sample is a malicious VBScript. For a few weeks, I started
[The post [SANS ISC] Simple Mimikatz & RDPWrapper Dropper has been first published on /dev/random]
Continue reading [SANS ISC] Simple Mimikatz & RDPWrapper Dropper
I published the following diary on isc.sans.edu: “May People Be Considered as IOC?“: That’s a tricky question! May we manage a list of people like regular IOC’s? An IOC (Indicator of Compromise) is a piece of information, usually technical, that helps to detect malicious (or at least suspicious) activities. Classic types
[The post [SANS ISC] May People Be Considered as IOC? has been first published on /dev/random]
Continue reading [SANS ISC] May People Be Considered as IOC?
This week, the second edition of “Pass-The-Salt” was organized in Lille, France. The conference was based on the same format at last year and organized at the same location (see my previous diary). I like this kind of event where you can really meet people (the number of attendees was
[The post Pass-The-Salt 2019 Wrap-Up has been first published on /dev/random]