Author Archives: Xavier

[SANS ISC] Diving into Malicious AutoIT Code

Posted on by

I published the following diary on isc.sans.edu: “Diving into Malicious AutoIT Code”: Following my yesterday diary, I had a deeper look at the malicious AutoIT script dropped in my sandbox. For those who are not aware of AutoIT, it is a BASIC-like scripting language designed for automating Windows tasks. If

[The post [SANS ISC] Diving into Malicious AutoIT Code has been first published on /dev/random]

Continue reading [SANS ISC] Diving into Malicious AutoIT Code→

[SANS ISC] Malicious Powershell using a Decoy Picture

Posted on by

I published the following diary on isc.sans.edu: “Malicious Powershell using a Decoy Picture“: I found another interesting piece of malicious Powershell while hunting. The file size is 1.3MB and most of the file is a PE file Base64 encoded. You can immediately detect it by checking the first characters of

[The post [SANS ISC] Malicious Powershell using a Decoy Picture has been first published on /dev/random]

Continue reading [SANS ISC] Malicious Powershell using a Decoy Picture→

Hack.lu 2018 Wrap-Up Day #3

Posted on by

Here we go with the last wrap-up of the 2018 edition! The first presentation was about worms: “Worms that turn: nematodes and neotodes” by Matt Wixey. The first slide contained the mention: “for educational purposes only”. What could we expect? The idea of the research performed by Matt was interesting.

[The post Hack.lu 2018 Wrap-Up Day #3 has been first published on /dev/random]

Continue reading Hack.lu 2018 Wrap-Up Day #3→

Hack.lu 2018 Wrap-Up Day #2

Posted on by

The second day started early with an eye-opener talk: “IPC – the broken dream of inherent security” by Thanh Bui. IPC or “Inter-Process Communications” are everywhere. You can compare them as a network connection between a client and a server but inside the operating system. The idea of Thanh’s research was

[The post Hack.lu 2018 Wrap-Up Day #2 has been first published on /dev/random]

Continue reading Hack.lu 2018 Wrap-Up Day #2→

Hack.lu 2018 Wrap-Up Day #1

Posted on by

The 14th edition (!) of hack.lu is ongoing in Luxembourg. I arrived yesterday to attend the MISP summit which was a success. It’s great to see that more and more people are using this information sharing platform to fight bad guys! Today, the conference officially started with the regular talk. I

[The post Hack.lu 2018 Wrap-Up Day #1 has been first published on /dev/random]

Continue reading Hack.lu 2018 Wrap-Up Day #1→

[SANS ISC] New Campaign Using Old Equation Editor Vulnerability

Posted on by

I published the following diary on isc.sans.edu: “New Campaign Using Old Equation Editor Vulnerability“:
Yesterday, I found a phishing sample that looked interesting:
From: sales@tjzxchem[.]com
To: me
Subject: RE: Re: Proforma Invoice INV 0… Continue reading [SANS ISC] New Campaign Using Old Equation Editor Vulnerability→

[SANS ISC] “OG” Tools Remain Valuable

Posted on by

I published the following diary on isc.sans.edu: “‘OG’ Tools Remain Valuable“: For vendors, the cybersecurity landscape is a nice place to make a very lucrative business. New solutions and tools are released every day and promise you to easily detect malicious activities on your networks. And it’s a recurring story.

[The post [SANS ISC] “OG” Tools Remain Valuable has been first published on /dev/random]

Continue reading [SANS ISC] “OG” Tools Remain Valuable→

[SANS ISC] More Excel DDE Code Injection

Posted on by

I published the following diary on isc.sans.edu: “More Excel DDE Code Injection“: The “DDE code injection” technique is not brand new. DDE stands for “Dynamic Data Exchange”. It has already been discussed by many security researchers. Just a quick reminder for those who missed it. In Excel, it is possible to

[The post [SANS ISC] More Excel DDE Code Injection has been first published on /dev/random]

Continue reading [SANS ISC] More Excel DDE Code Injection→