Author Archives: Xavier

[SANS ISC] Obfuscated bash script targeting QNap boxes

Posted on by

I published the following diary on isc.sans.edu: “Obfuscated bash script targeting QNap boxes“: One of our readers, Nathaniel Vos, shared an interesting shell script with us and thanks to him! He found it on an embedded Linux device, more precisely, a QNap NAS running QTS 4.3. After some quick investigations,

[The post [SANS ISC] Obfuscated bash script targeting QNap boxes has been first published on /dev/random]

Continue reading [SANS ISC] Obfuscated bash script targeting QNap boxes→

[SANS ISC] Divided Payload in Multiple Pasties

Posted on by

I published the following diary on isc.sans.edu: “Divided Payload in Multiple Pasties”: In politic, there is a strategy which says “divide and conquer”. It’s also true for some pieces of malware that spread their malicious code amongst multiple sources. One of our readers shared a sample of Powershell code found

[The post [SANS ISC] Divided Payload in Multiple Pasties has been first published on /dev/random]

Continue reading [SANS ISC] Divided Payload in Multiple Pasties→

[SANS ISC] Querying DShield from Cortex

Posted on by

I published the following diary on isc.sans.edu: “Querying DShield from Cortex”: Cortex is a tool part of the TheHive project. As stated on the website, it is a “Powerful Observable Analysis Engine”. Cortex can analyze observables like IP addresses, emails, hashes, filenames against a huge (and growing) list of online services.

[The post [SANS ISC] Querying DShield from Cortex has been first published on /dev/random]

Continue reading [SANS ISC] Querying DShield from Cortex→

[SANS ISC] The Challenge of Managing Your Digital Library

Posted on by

I published the following diary on isc.sans.edu: “The Challenge of Managing Your Digital Library”: How do you manage your digital library on a daily basis? If like me, you are receiving a lot of emails, notifications, tweets, [name your best technology here], they are chances that you’re flooded by tons

[The post [SANS ISC] The Challenge of Managing Your Digital Library has been first published on /dev/random]

Continue reading [SANS ISC] The Challenge of Managing Your Digital Library→

[SANS ISC] Quickly Investigating Websites with Lookyloo

Posted on by

I published the following diary on isc.sans.edu: “Quickly Investigating Websites with Lookyloo”: While we are enjoying our weekend, it’s always a good time to learn about new pieces of software that could be added to your toolbox. Security analysts have often to quickly investigate a website for malicious content and

[The post [SANS ISC] Quickly Investigating Websites with Lookyloo has been first published on /dev/random]

Continue reading [SANS ISC] Quickly Investigating Websites with Lookyloo→

[SANS ISC] Basic Obfuscation With Permissive Languages

Posted on by

I published the following diary on isc.sans.edu: “Basic Obfuscation With Permissive Languages”: For attackers, obfuscation is key to keep their malicious code below the radar. Code is obfuscated for two main reasons: defeat automatic detection by AV solutions or tools like YARA (which still rely mainly on signatures) and make the code

[The post [SANS ISC] Basic Obfuscation With Permissive Languages has been first published on /dev/random]

Continue reading [SANS ISC] Basic Obfuscation With Permissive Languages→

Passive DNS for the Bad

Posted on by

Passive DNS is not a new technique but, for the last months, there was more and more noise around it. Passive DNS is a technique used to record all resolution requests performed by DNS resolvers (bigger they are, bigger they will collect) and then allow to search for historical data.

[The post Passive DNS for the Bad has been first published on /dev/random]

Continue reading Passive DNS for the Bad→

[SANS ISC] Malicious Powershell Script Dissection

Posted on by

I published the following diary on isc.sans.edu: “Malicious Powershell Script Dissection”: Here is another example of malicious Powershell script found while hunting. Such scripts remain a common attack vector and many of them can be easily detected just by looking for some specific strings. Here is an example of YARA

[The post [SANS ISC] Malicious Powershell Script Dissection has been first published on /dev/random]

Continue reading [SANS ISC] Malicious Powershell Script Dissection→

Post-BruCON Experience – Running a Wall of Sheep in the Wild

Posted on by

The use of a Wall of Sheep is nice to raise the security awareness of your audience. A Wall of Sheep is a tool used to demonstrate what can happen when users connect to a wild network without a minimum level of security. The non-encrypted traffic is analyzed and evidence of bad behaviour is displayed publicly

[The post Post-BruCON Experience – Running a Wall of Sheep in the Wild has been first published on /dev/random]

Continue reading Post-BruCON Experience – Running a Wall of Sheep in the Wild→

[SANS ISC] Dissecting Malicious Office Documents with Linux

Posted on by

I published the following diary on isc.sans.edu: “Dissecting Malicious Office Documents with Linux”: A few months ago, Rob wrote a nice diary to explain how to dissect a (malicious) Office document (.docx). The approach was to use the OpenXML SDK with Powershell. This is nice but how to achieve the

[The post [SANS ISC] Dissecting Malicious Office Documents with Linux has been first published on /dev/random]

Continue reading [SANS ISC] Dissecting Malicious Office Documents with Linux→