Author Archives: Xavier

[SANS ISC] Interesting JavaScript Obfuscation Example

Posted on by

I published the following diary on isc.sans.edu: “Interesting JavaScript Obfuscation Example“: Last Friday, one of our reader (thanks Mickael!) reported to us a phishing campaign based on a simple HTML page. He asked us how to properly extract the malicious code within the page. I did an analysis of the

[The post [SANS ISC] Interesting JavaScript Obfuscation Example has been first published on /dev/random]

Continue reading [SANS ISC] Interesting JavaScript Obfuscation Example→

[SANS ISC] Behavioural Malware Analysis with Microsoft ASA

Posted on by

I published the following diary on isc.sans.edu: “Behavioural Malware Analysis with Microsoft ASA“: When you need to quickly analyze a piece of malware (or just a suspicious program), your goal is to determine as quickly as possible what’s the impact. In many cases, we don’t have time to dive very

[The post [SANS ISC] Behavioural Malware Analysis with Microsoft ASA has been first published on /dev/random]

Continue reading [SANS ISC] Behavioural Malware Analysis with Microsoft ASA→

[SANS ISC] The Risk of Authenticated Vulnerability Scans

Posted on by

I published the following diary on isc.sans.edu: “The Risk of Authenticated Vulnerability Scans“: NTLM relay attacks have been a well-known opportunity to perform attacks against Microsoft Windows environments for a while and they remain usually successful. The magic with NTLM relay attacks? You don’t need to lose time to crack

[The post [SANS ISC] The Risk of Authenticated Vulnerability Scans has been first published on /dev/random]

Continue reading [SANS ISC] The Risk of Authenticated Vulnerability Scans→

[SANS ISC] From Phishing To Ransomware?

Posted on by

I published the following diary on isc.sans.edu: “From Phishing To Ransomware?“: On Friday, one of our readers reported a phishing attempt to us (thanks to him!). Usually, those emails are simply part of classic phishing waves and try to steal credentials from victims but, this time, it was not a

[The post [SANS ISC] From Phishing To Ransomware? has been first published on /dev/random]

Continue reading [SANS ISC] From Phishing To Ransomware?→

[SANS ISC] DSSuite – A Docker Container with Didier’s Tools

Posted on by

I published the following diary on isc.sans.edu: “DSSuite – A Docker Container with Didier’s Tools“: If you follow us and read our daily diaries, you probably already know some famous tools developed by Didier (like oledump.py, translate.py and many more). Didier is using them all the time to analyze malicious

[The post [SANS ISC] DSSuite – A Docker Container with Didier’s Tools has been first published on /dev/random]

Continue reading [SANS ISC] DSSuite – A Docker Container with Didier’s Tools→

[SANS] Another Day, Another Suspicious UDF File

Posted on by

I published the following diary on isc.sans.edu: “Another Day, Another Suspicious UDF File“: In my last diary, I explained that I found a malcious UDF image used to deliver a piece of malware. After this, I created a YARA rule on VT to try to spot more UDF files in

[The post [SANS] Another Day, Another Suspicious UDF File has been first published on /dev/random]

Continue reading [SANS] Another Day, Another Suspicious UDF File→

[SANS ISC] Malware Sample Delivered Through UDF Image

Posted on by

I published the following diary on isc.sans.edu: “Malware Sample Delivered Through UDF Image“: I found an interesting phishing email which was delivered with a malicious attachment: an UDF image (.img). UDF means “Universal Disk Format” and, as said by Wikipedia], is an open vendor-neutral file system for computer data storage. It

[The post [SANS ISC] Malware Sample Delivered Through UDF Image has been first published on /dev/random]

Continue reading [SANS ISC] Malware Sample Delivered Through UDF Image→

[SANS ISC] New Waves of Scans Detected by an Old Rule

Posted on by

I published the following diary on isc.sans.edu: “New Waves of Scans Detected by an Old Rule“: Who remembers the famous ShellShock (CVE-2014-6271)? This bug affected the bash shell in 2014 and was critical due to the facts that it was easy to exploit and that bash is a widespread shell

[The post [SANS ISC] New Waves of Scans Detected by an Old Rule has been first published on /dev/random]

Continue reading [SANS ISC] New Waves of Scans Detected by an Old Rule→

[SANS ISC] Running your Own Passive DNS Service

Posted on by

I published the following diary on isc.sans.edu: “Running your Own Passive DNS Service“: Passive DNS is not new but remains a very interesting component to have in your hunting arsenal. As defined by CIRCL, a passive DNS is “a database storing historical DNS records from various resources. The historical data

[The post [SANS ISC] Running your Own Passive DNS Service has been first published on /dev/random]

Continue reading [SANS ISC] Running your Own Passive DNS Service→