Author Archives: Xavier

[SANS ISC] New Wave of Extortion Emails: Central Intelligence Agency Case

Posted on by

I published the following diary on isc.sans.edu: “New Wave of Extortion Emails: Central Intelligence Agency Case“: The extortion attempts haved moved to another step recently. After the “sextortion” emails that are propagating for a while, attackers started to flood people with a new type of fake emails and their imaginnation is endless… I

[The post [SANS ISC] New Wave of Extortion Emails: Central Intelligence Agency Case has been first published on /dev/random]

Continue reading [SANS ISC] New Wave of Extortion Emails: Central Intelligence Agency Case→

[SANS ISC] Keep an Eye on Disposable Email Addresses

Posted on by

I published the following diary on isc.sans.edu: “Keep an Eye on Disposable Email Addresses“: In many organisations, emails still remain a classic infection path today. The good old email is still today a common communication channel to exchange information with people outside of the security perimeter. Many security controls are

[The post [SANS ISC] Keep an Eye on Disposable Email Addresses has been first published on /dev/random]

Continue reading [SANS ISC] Keep an Eye on Disposable Email Addresses→

[SANS ISC] Simple Powershell Keyloggers are Back

Posted on by

I published the following diary on isc.sans.edu: “Simple Powershell Keyloggers are Back”: Powershell is a very nice language in Windows environments. With only a few lines of code, we can implement nice features… for the good or the bad! While hunting, I found a bunch of malicious Powershell scripts that

[The post [SANS ISC] Simple Powershell Keyloggers are Back has been first published on /dev/random]

Continue reading [SANS ISC] Simple Powershell Keyloggers are Back→

Detecting Mobile Phones Close to Your Location

Posted on by

Last week, I had a unique opportunity to attend a demo of a “cool” product (I insist on the quotes around cool): A complete solution to track and intercept mobile devices. The company presents itself as a partner of law enforcement services, governments or special agencies (you know all the

[The post Detecting Mobile Phones Close to Your Location has been first published on /dev/random]

Continue reading Detecting Mobile Phones Close to Your Location→

[SANS ISC] Old H-Worm Delivered Through GitHub

Posted on by

I published the following diary on isc.sans.edu: “Old H-Worm Delivered Through GitHub”: Another piece of malicious code spotted on GitHub this time. By the way, this is the perfect example to demonstrate that protecting users via a proxy with web-categorization is useless… Event sites from the Alexa Top-1M may deliver

[The post [SANS ISC] Old H-Worm Delivered Through GitHub has been first published on /dev/random]

Continue reading [SANS ISC] Old H-Worm Delivered Through GitHub→

[SANS ISC] Suspicious PDF Connecting to a Remote SMB Share

Posted on by

I published the following diary on isc.sans.edu: “Suspicious PDF Connecting to a Remote SMB Share”: Yesterday I stumbled upon a PDF file that was flagged as suspicious by a customer’s anti-malware solution and placed in the quarantine. Later, the recipient contacted the team in charge of emails to access his document because

[The post [SANS ISC] Suspicious PDF Connecting to a Remote SMB Share has been first published on /dev/random]

Continue reading [SANS ISC] Suspicious PDF Connecting to a Remote SMB Share→

[SANS ISC] Tracking Unexpected DNS Changes

Posted on by

I published the following diary on isc.sans.edu: “Tracking Unexpected DNS Changes”: DNS is a key element of the Internet and, regularly, we read new bad stories. One of the last one was the Department of Homeland Security warning about recent DNS hijacking attacks. Indeed, when you want to visit the website ‘isc.sans.org’, you

[The post [SANS ISC] Tracking Unexpected DNS Changes has been first published on /dev/random]

Continue reading [SANS ISC] Tracking Unexpected DNS Changes→

[SANS ISC] DNS Firewalling with MISP

Posted on by

I published the following diary on isc.sans.edu: “DNS Firewalling with MISP”: If IOC’s are very useful to “detect” suspicious activities, why not use also them to “prevent” them to occur? DNS firewalling can be an efficient way to prevent your users to visit malicious online resources. The principle of DNS firewalling

[The post [SANS ISC] DNS Firewalling with MISP has been first published on /dev/random]

Continue reading [SANS ISC] DNS Firewalling with MISP→

[SANS ISC] Malicious Script Leaking Data via FTP

Posted on by

I published the following diary on isc.sans.edu: “Malicious Script Leaking Data via FTP”: The last day of 2018, I found an interesting Windows cmd script which was uploaded from India (SHA256: dff5fe50aae9268ae43b76729e7bb966ff4ab2be1bd940515cbfc0f0ac6b65ef) with a very low VT score. The script is not obfuscated and contains a long list of commands based on

[The post [SANS ISC] Malicious Script Leaking Data via FTP has been first published on /dev/random]

Continue reading [SANS ISC] Malicious Script Leaking Data via FTP→