Author Archives: Xavier

[SANS ISC] Using OSSEC Active-Response as a DFIR Framework

Posted on by

I published the following diary on isc.sans.edu: “Using OSSEC Active-Response as a DFIR Framework”: In most of our networks, endpoints are often the weakest link because there are more difficult to control (example: laptops are travelling, used at home, etc).They can also be located in different locations even countries for

[The post [SANS ISC] Using OSSEC Active-Response as a DFIR Framework has been first published on /dev/random]

Continue reading [SANS ISC] Using OSSEC Active-Response as a DFIR Framework→

“Hunting with OSSEC” at BruCON Spring Training

Posted on by

My training submission has been accepted at the BruCON Spring Training session in April 2019. This training is intended for Blue Team members and system/security engineers who would like to take advantage of the OSSEC integration capabilities with other tools and increase the visibility of their infrastructure behaviour. OSSEC is sometimes described as

[The post “Hunting with OSSEC” at BruCON Spring Training has been first published on /dev/random]

Continue reading “Hunting with OSSEC” at BruCON Spring Training→

[SANS ISC] Restricting PowerShell Capabilities with NetSh

Posted on by

I published the following diary on isc.sans.edu: “Restricting PowerShell Capabilities with NetSh“: The Christmas break is coming for most of us, let’s take some time to share some tips to better protect our computers. The Microsoft Windows OS has plenty of tools that, when properly used, can reduce risks to be

[The post [SANS ISC] Restricting PowerShell Capabilities with NetSh has been first published on /dev/random]

Continue reading [SANS ISC] Restricting PowerShell Capabilities with NetSh→

[SANS ISC] Phishing Attack Through Non-Delivery Notification

Posted on by

I published the following diary on isc.sans.edu: “Phishing Attack Through Non-Delivery Notification”: Here is a nice example of phishing attack that I found while reviewing data captured by my honeypots. We all know that phishing is a pain and attackers are always searching for new tactics to entice the potential victim to

[The post [SANS ISC] Phishing Attack Through Non-Delivery Notification has been first published on /dev/random]

Continue reading [SANS ISC] Phishing Attack Through Non-Delivery Notification→

Nominated for the IT Blog Awards

Posted on by

This morning, I received a mail from Cisco to tell me that I’ve been nominated as finalist for their IT Blog Awards (Category: “Most Inspirational”). I’m maintaining this blog just for the fun and to share useful (I hope) information with my readers and don’t do this to get rewards

[The post Nominated for the IT Blog Awards has been first published on /dev/random]

Continue reading Nominated for the IT Blog Awards→

Botconf 2018 Wrap-Up Day #3

Posted on by

And the conference is over! I’m flying back to home by tomorrow morning so I’ve time to write my third wrap-up. The last day of the conference is always harder for many attendees due to the late parties. But I was present on time to attend the last set of

[The post Botconf 2018 Wrap-Up Day #3 has been first published on /dev/random]

Continue reading Botconf 2018 Wrap-Up Day #3→

Botconf 2018 Wrap-Up Day #2

Posted on by

I’m just back from the reception that was held at the Cité de l’Espace, such a great place with animations and exhibitions of space related devices. It’s tie for my wrap-up of the second day. This morning, after some coffee refill, the first talk of the day was performed by Jose

[The post Botconf 2018 Wrap-Up Day #2 has been first published on /dev/random]

Continue reading Botconf 2018 Wrap-Up Day #2→

Botconf 2018 Wrap-Up Day #1

Posted on by

Here is my first wrap-up for the 6th edition of the Botconf security conference. Like the previous editions, the event is organized in a different location in France. This year, the beautiful city of Toulouse saw 400 people flying from all over the world to attend the conference dedicated to

[The post Botconf 2018 Wrap-Up Day #1 has been first published on /dev/random]

Continue reading Botconf 2018 Wrap-Up Day #1→

DeepSec 2018 Wrap-Up

Posted on by

I’m writing this quick wrap-up in Vienna, Austria where I attended my first DeepSec conference. This event was already on my schedule for a while but I never had a chance to come. This year, I submitted a training and I was accepted! Good opportunity to visit the beautiful city

[The post DeepSec 2018 Wrap-Up has been first published on /dev/random]

Continue reading DeepSec 2018 Wrap-Up→

[SANS ISC] More obfuscated shell scripts: Fake MacOS Flash update

Posted on by

I published the following diary on isc.sans.edu: “More obfuscated shell scripts: Fake MacOS Flash update”: Yesterday, I wrote a diary about a nice obfuscated shell script. Today, I found another example of a malicious shell script embedded in an Apple .dmg file (an Apple Disk Image). The file was delivered through

[The post [SANS ISC] More obfuscated shell scripts: Fake MacOS Flash update has been first published on /dev/random]

Continue reading [SANS ISC] More obfuscated shell scripts: Fake MacOS Flash update→