Author Archives: Xavier

[SANS ISC] Malicious DLL Loaded Through AutoIT

Posted on by

I published the following diary on isc.sans.org: “Malicious DLL Loaded Through AutoIT“: Here is an interesting sample that I found while hunting. It started with the following URL: hxxp://200[.]98[.]170[.]29/uiferuisdfj/W5UsPk.php?Q8T3=OQlLg3rUFVE740gn1T3LjoPCQKxAL1i6WoY34y2o73Ap3C80lvTr9FM5 The value of the parameter (‘OQlLg3rUFVE740gn1T3LjoPCQKxAL1i6WoY34y2o73Ap3C80lvTr9FM5’) is used as the key to decode the first stage. If you don’t specify it,

[The post [SANS ISC] Malicious DLL Loaded Through AutoIT has been first published on /dev/random]

Continue reading [SANS ISC] Malicious DLL Loaded Through AutoIT→

Training Announce: “Hunting with OSSEC”

Posted on by

I’m proud to have been selected to give a training at DeepSec (Vienna, Austria) in November: “Hunting with OSSEC“. This training is intended for Blue Team members and system/security engineers who would like to take advantage of the OSSEC integration capabilities with other tools and increase the visibility of their infrastructure behaviour.

[The post Training Announce: “Hunting with OSSEC” has been first published on /dev/random]

Continue reading Training Announce: “Hunting with OSSEC”→

Detecting SSH Username Enumeration

Posted on by

A very quick post about a new thread which has been started yesterday on the OSS-Security mailing list. It’s about a vulnerability affecting almost ALL SSH server version. Quoted from the initial message; It affects all operating systems, all OpenSSH versions (we went back as far as OpenSSH 2.3.0, released

[The post Detecting SSH Username Enumeration has been first published on /dev/random]

Continue reading Detecting SSH Username Enumeration→

[SANS ISC] Truncating Payloads and Anonymizing PCAP files

Posted on by

I published the following diary on isc.sans.org: “Truncating Payloads and Anonymizing PCAP files“: Sometimes, you may need to provide PCAP files to third-party organizations like a vendor support team to investigate a problem with your network. I was looking for a small tool to anonymize network traffic but also to

[The post [SANS ISC] Truncating Payloads and Anonymizing PCAP files has been first published on /dev/random]

Continue reading [SANS ISC] Truncating Payloads and Anonymizing PCAP files→

[SANS ISC] Exploiting the Power of Curl

Posted on by

I published the following diary on isc.sans.org: “Exploiting the Power of Curl“: Didier explained in a recent diary that it is possible to analyze malicious documents with standard Linux tools. I’m using Linux for more than 20 years and, regularly, I find new commands or new switches that help me

[The post [SANS ISC] Exploiting the Power of Curl has been first published on /dev/random]

Continue reading [SANS ISC] Exploiting the Power of Curl→

[SANS ISC] Windows Batch File Deobfuscation

Posted on by

I published the following diary on isc.sans.org: “Windows Batch File Deobfuscation“: Last Thursday, Brad published a diary about a new ongoing campaign delivering the Emotet malware. I found another sample that looked the same. My sample was called ‘Order-42167322776.doc’ (SHA256:4d600ae3bbdc846727c2922485f9f7ec548a3dd031fc206dbb49bd91536a56e3 and looked the same as the one analyzed Brad. The

[The post [SANS ISC] Windows Batch File Deobfuscation has been first published on /dev/random]

Continue reading [SANS ISC] Windows Batch File Deobfuscation→

Another Cryptominer Delivered Through Altered JQuery.js File

Posted on by

A few days ago, I published a diary on the SANS Internet Storm Center website about a Javascript file that was altered to deliver a cryptominer into the victim’s browser. Since my first finding, I’m hunting for more samples. The best way to identify them is to search for the following

[The post Another Cryptominer Delivered Through Altered JQuery.js File has been first published on /dev/random]

Continue reading Another Cryptominer Delivered Through Altered JQuery.js File→

[SANS ISC] Searching for Geographically Improbable Login Attempts

Posted on by

I published the following diary on isc.sans.org: “Searching for Geographically Improbable Login Attempts“: For the human brain, an IP address is not the best IOC because, like phone numbers, we are bad to remember them. That’s why DNS was created. But, in many log management applications, there are features to

[The post [SANS ISC] Searching for Geographically Improbable Login Attempts has been first published on /dev/random]

Continue reading [SANS ISC] Searching for Geographically Improbable Login Attempts→

[SANS ISC] Cryptominer Delivered Though Compromized JavaScript File

Posted on by

I published the following diary on isc.sans.org: “Cryptominer Delivered Though Compromized JavaScript File“: Yesterday I found an interesting compromised JavaScript file that contains extra code to perform crypto mining activities. It started with a customer’s IDS alerts on the following URL: hxxp://safeyourhealth[.]ru/wp-content/themes/wp-trustme/js/jquery.prettyphoto.js This website is not referenced as malicious and the

[The post [SANS ISC] Cryptominer Delivered Though Compromized JavaScript File has been first published on /dev/random]

Continue reading [SANS ISC] Cryptominer Delivered Though Compromized JavaScript File→

Imap2TheHive: Support for Custom Observables

Posted on by

I’m using OSSEC to feed an instance of TheHive to investigate security incidents reported by OSSEC. To better categorize the alerts and merge similar events, I needed to add more observables. OSSEC alerts are delivered by email with interesting information for TheHive. This was an interesting use case to play

[The post Imap2TheHive: Support for Custom Observables has been first published on /dev/random]

Continue reading Imap2TheHive: Support for Custom Observables→