Author Archives: Xavier

[SANS ISC] Hunting for Suspicious Processes with OSSEC

Posted on by

I published the following diary on isc.sans.edu: “Hunting for Suspicious Processes with OSSEC“: Here is a quick example of how OSSEC can be helpful to perform threat hunting. OSSEC  is a free security monitoring tool/log management platform which has many features related to detecting malicious activity on a live system like the

[The post [SANS ISC] Hunting for Suspicious Processes with OSSEC has been first published on /dev/random]

Continue reading [SANS ISC] Hunting for Suspicious Processes with OSSEC→

[SANS ISC] Malware Delivered Through MHT Files

Posted on by

I published the following diary on isc.sans.edu: “Malware Delivered Through MHT Files“: What are MHT files? Microsoft is a wonderful source of multiple file formats. MHT files are web page archives. Usually, a web page is based on a piece of HTML code with links to external resources, images and other

[The post [SANS ISC] Malware Delivered Through MHT Files has been first published on /dev/random]

Continue reading [SANS ISC] Malware Delivered Through MHT Files→

Wanna Come to BruCON? Solve This Challenge!

Posted on by

Wow, 10  years already! In a few weeks, this is the 10th edition of BruCON or the “0x0A edition“. If you know me or follow me, you probably know that I’m part of this wonderful experience since the first edition. I’m also sponsoring the conference through my company with a

[The post Wanna Come to BruCON? Solve This Challenge! has been first published on /dev/random]

Continue reading Wanna Come to BruCON? Solve This Challenge!→

[SANS ISC] Crypto Mining in a Windows Headless Browser

Posted on by

I published the following diary on isc.sans.edu: “Crypto Mining in a Windows Headless Browser“: Crypto miners in the browser are not new. Delivery through malicious or compromised piece of javascript code is common these days (see my previous diary about this topic). This time, it’s another way to deliver the

[The post [SANS ISC] Crypto Mining in a Windows Headless Browser has been first published on /dev/random]

Continue reading [SANS ISC] Crypto Mining in a Windows Headless Browser→

[SANS ISC] Malicious PowerShell Compiling C# Code on the Fly

Posted on by

I published the following diary on isc.sans.edu: “Malicious PowerShell Compiling C# Code on the Fly“: What I like when hunting is to discover how attackers are creative to find new ways to infect their victim’s computers. I came across a Powershell sample that looked new and interesting to me. First,

[The post [SANS ISC] Malicious PowerShell Compiling C# Code on the Fly has been first published on /dev/random]

Continue reading [SANS ISC] Malicious PowerShell Compiling C# Code on the Fly→

Hack.lu 2018 is ahead!

Posted on by

During this summer, I went to SANSFire, Defcon and BSidesLV. Usually, the month of September is lighter without big events for me. This is to prepare for the next wave of conferences ahead! Of course, BruCON will be held on the first week of October but, especially, Hack.lu which remains one of my favourite

[The post Hack.lu 2018 is ahead! has been first published on /dev/random]

Continue reading Hack.lu 2018 is ahead!→

[SANS ISC] Crypto Mining Is More Popular Than Ever!

Posted on by

I published the following diary on isc.sans.edu: “Crypto Mining Is More Popular Than Ever!“: We already wrote some diaries about crypto miners and they remain more popular than ever. Based on my daily hunting statistics, we can see that malicious scripts performing crypto mining operations remain on top of the

[The post [SANS ISC] Crypto Mining Is More Popular Than Ever! has been first published on /dev/random]

Continue reading [SANS ISC] Crypto Mining Is More Popular Than Ever!→

[SANS ISC] 3D Printers in The Wild, What Can Go Wrong?

Posted on by

I published the following diary on isc.sans.edu: “3D Printers in The Wild, What Can Go Wrong?“: Richard wrote a quick diary yesterday about an interesting information that we received from one of our readers. It’s about a huge amount of OctoPrint interfaces that are publicly facing the Internet. Octoprint is

[The post [SANS ISC] 3D Printers in The Wild, What Can Go Wrong? has been first published on /dev/random]

Continue reading [SANS ISC] 3D Printers in The Wild, What Can Go Wrong?→

[SANS ISC] Microsoft Publisher Files Delivering Malware

Posted on by

I published the following diary on isc.sans.org: “Microsoft Publisher Files Delivering Malware“: Attackers are always searching for new ways to deliver malicious content to their victims. A few days ago, Microsoft Publisher malicious files were spotted by security researchers[1]. Publisher is a low-level desktop publishing application offered by Microsoft in

[The post [SANS ISC] Microsoft Publisher Files Delivering Malware has been first published on /dev/random]

Continue reading [SANS ISC] Microsoft Publisher Files Delivering Malware→

[SANS ISC] Simple Phishing Through formcrafts.com

Posted on by

I published the following diary on isc.sans.org: “Simple Phishing Through formcrafts.com“: For a long time, moving services to the cloud has been a major trend. Many organizations jumped into the cloud because it’s much easier and cost less money (in terms of maintenance, licence, electricity, etc). If so, why should bad

[The post [SANS ISC] Simple Phishing Through formcrafts.com has been first published on /dev/random]

Continue reading [SANS ISC] Simple Phishing Through formcrafts.com→