Author Archives: Xavier

[SANS ISC] Converting PCAP Web Traffic to Apache Log

Posted on by

I published the following diary on isc.sans.org: “Converting PCAP Web Traffic to Apache Log“: PCAP data can be really useful when you must investigate an incident but when the amount of PCAP files to analyse is counted in gigabytes, it may quickly become tricky to handle. Often, the first protocol

[The post [SANS ISC] Converting PCAP Web Traffic to Apache Log has been first published on /dev/random]

Continue reading [SANS ISC] Converting PCAP Web Traffic to Apache Log→

[SANS ISC] Malicious Post-Exploitation Batch File

Posted on by

I published the following diary on isc.sans.org: “Malicious Post-Exploitation Batch File“: Here is another interesting file that I found while hunting. It is a malicious Windows batch file (.bat) which helps to exploit a freshly compromised system (or… to be used by a rogue user). I don’t have a lot of

[The post [SANS ISC] Malicious Post-Exploitation Batch File has been first published on /dev/random]

Continue reading [SANS ISC] Malicious Post-Exploitation Batch File→

[SANS ISC] Antivirus Evasion? Easy as 1,2,3

Posted on by

I published the following diary on isc.sans.org: “Antivirus Evasion? Easy as 1,2,3“: For a while, ISC handlers have demonstrated several obfuscation techniques via our diaries. We always told you that attackers are trying to find new techniques to hide their content to not be flagged as malicious by antivirus products.

[The post [SANS ISC] Antivirus Evasion? Easy as 1,2,3 has been first published on /dev/random]

Continue reading [SANS ISC] Antivirus Evasion? Easy as 1,2,3→

[SANS ISC] “Blocked” Does Not Mean “Forget It”

Posted on by

I published the following diary on isc.sans.org: “Blocked Does Not Mean Forget It“: Today, organisations are facing regular waves of attacks which are targeted… or not. We deploy tons of security controls to block them as soon as possible before they successfully reach their targets. Due to the amount of

[The post [SANS ISC] “Blocked” Does Not Mean “Forget It” has been first published on /dev/random]

Continue reading [SANS ISC] “Blocked” Does Not Mean “Forget It”→

The Evil Mouse Project

Posted on by

In March during TROOPERS’18, I discovered a very nice tiny device developed by Luca Bongiorni (see my wrap-up here): The WiFi HID Injector. Just to resume what’s behind this name, we have a small USB evil device which offers: a Wireless access point for the configuration and exfiltration of data, an HID

[The post The Evil Mouse Project has been first published on /dev/random]

Continue reading The Evil Mouse Project→

[SANS ISC] Malware Distributed via .slk Files

Posted on by

I published the following diary on isc.sans.org: “Malware Distributed via .slk Files“: Attackers are always trying to find new ways to infect computers by luring not only potential victims but also security controls like anti-virus products. Do you know what SYLK files are? SYmbolic LinK files (they use the .slk

[The post [SANS ISC] Malware Distributed via .slk Files has been first published on /dev/random]

Continue reading [SANS ISC] Malware Distributed via .slk Files→

Rendering Suspicious EML Files

Posted on by

Sometimes, a security incident starts with an email. A suspicious email can be provided to a security analyst for further investigation. Most of the time, the mail is provided in EML or “Electronic Mail Format“. EML files store the complete message in a single file: SMTP headers, mail body and all

[The post Rendering Suspicious EML Files has been first published on /dev/random]

Continue reading Rendering Suspicious EML Files→

[SANS ISC] Malicious Powershell Targeting UK Bank Customers

Posted on by

I published the following diary on isc.sans.org: “Malicious Powershell Targeting UK Bank Customers”: I found a very interesting sample thanks to my hunting rules… It is a PowerShell script that was uploaded on VT for the first time on the 16th of May from UK. The current VT score is still

[The post [SANS ISC] Malicious Powershell Targeting UK Bank Customers has been first published on /dev/random]

Continue reading [SANS ISC] Malicious Powershell Targeting UK Bank Customers→

Imap2TheHive: Support for Observables

Posted on by

I just published a new update of my imap2thehive tool. A quick reminder: this tool is aimed to poll an IMAP mailbox and feed an instance of TheHive with processed emails. This new version is now able to extract interesting IOCs from the email body and attached HTML files. The following indicators are

[The post Imap2TheHive: Support for Observables has been first published on /dev/random]

Continue reading Imap2TheHive: Support for Observables→

[SANS ISC] Nice Phishing Sample Delivering Trickbot

Posted on by

I published the following diary on isc.sans.org: “Nice Phishing Sample Delivering Trickbot“: Users have to deal with phishing for a very long time. Today, most of them remain dumb messages quickly redacted with a simple attached file and a message like “Click on me, it’s urgent!”. Yesterday, I put my

[The post [SANS ISC] Nice Phishing Sample Delivering Trickbot has been first published on /dev/random]

Continue reading [SANS ISC] Nice Phishing Sample Delivering Trickbot→