Author Archives: Xavier

[SANS ISC] Adding Persistence Via Scheduled Tasks

Posted on by

I published the following diary on isc.sans.org: “Adding Persistence Via Scheduled Tasks“: Once a computer has been infected by a malware, one of the next steps to perform is to keep persistence. Usually, endpoints (workstations) are primary infection vectors due to the use made of it by people: they browse

[The post [SANS ISC] Adding Persistence Via Scheduled Tasks has been first published on /dev/random]

Continue reading [SANS ISC] Adding Persistence Via Scheduled Tasks→

[SANS ISC] Malicious Network Traffic From /bin/bash

Posted on by

I published the following diary on isc.sans.org: “Malicious Network Traffic From /bin/bash“: One of our readers from Germany sent me a malicious shell script captured by our honeypot running on his Raspberry.  It’s a simple UNIX Bash script that performs a bunch of malicious tasks: Kills existing crypto miner processes

[The post [SANS ISC] Malicious Network Traffic From /bin/bash has been first published on /dev/random]

Continue reading [SANS ISC] Malicious Network Traffic From /bin/bash→

[SANS ISC] The real value of an IOC?

Posted on by

I published the following diary on isc.sans.org: “The real value of an IOC?“: When a new malware sample is analysed by a security researcher, details are usually posted online with details of the behaviour and, based on this, a list of IOCs or “Indicators of Compromise” is published. Those indicators

[The post [SANS ISC] The real value of an IOC? has been first published on /dev/random]

Continue reading [SANS ISC] The real value of an IOC?→

FIRST Technical Colloquium Amsterdam 2018 Wrap-Up

Posted on by

I’m just back from the 2018 edition of the FIRST TC (“Technical Colloquium”) organized in Amsterdam. This was the second edition for me. The format was the same, one day of workshops and two days with normal presentations. And always 100% free! During the quick introduction, Jeff Bollinger from Cisco, which

[The post FIRST Technical Colloquium Amsterdam 2018 Wrap-Up has been first published on /dev/random]

Continue reading FIRST Technical Colloquium Amsterdam 2018 Wrap-Up→

[SANS ISC] Webshell looking for interesting files

Posted on by

I published the following diary on isc.sans.org: “Webshell looking for interesting files“: Yesterday, I found on Pastebin a bunch of samples of a webshell that integrates an interesting feature: It provides a console mode that you can use to execute commands on the victim host. The look and feel of the

[The post [SANS ISC] Webshell looking for interesting files has been first published on /dev/random]

Continue reading [SANS ISC] Webshell looking for interesting files→

[SANS ISC] A Suspicious Use of certutil.exe

Posted on by

I published the following diary on isc.sans.org: “A Suspicious Use of certutil.exe“: The Microsoft operating system is full of command line tools that help to perform administrative tasks. Some can be easily installed, like the SysInternal suite[1] and psexec.exe, others are builtin in Windows and available to everybody. The presence of

[The post [SANS ISC] A Suspicious Use of certutil.exe has been first published on /dev/random]

Continue reading [SANS ISC] A Suspicious Use of certutil.exe→

Facebook Archives Predictive Name: Some Found Online

Posted on by

Facebook is in the news for a few days after the disclosure of the Cambridge Analytica scandal. A few days ago, another wave of rumours revealed that the Facebook app could collect your private data. Facebook denied and a ping-pong game started. Is it true or false? The fact is

[The post Facebook Archives Predictive Name: Some Found Online has been first published on /dev/random]

Continue reading Facebook Archives Predictive Name: Some Found Online→

[SANS ISC] How are Your Vulnerabilities?

Posted on by

I published the following diary on isc.sans.org: “How are Your Vulnerabilities?“: Scanning assets for known vulnerabilities is a mandatory process in many organisations. This topic comes in the third position of the CIS Top-20. The major issue with a vulnerability scanning process is not on the technical side but more

[The post [SANS ISC] How are Your Vulnerabilities? has been first published on /dev/random]

Continue reading [SANS ISC] How are Your Vulnerabilities?→

[SANS ISC] Windows IRC Bot in the Wild

Posted on by

I published the following diary on isc.sans.org: “Windows IRC Bot in the Wild“: Last weekend, I caught on VirusTotal a trojan disguised as Windows IRC bot. It was detected thanks to my ‘psexec’ hunting rule which looks definitively an interesting keyword (see my previous diary). I detected the first occurrence

[The post [SANS ISC] Windows IRC Bot in the Wild has been first published on /dev/random]

Continue reading [SANS ISC] Windows IRC Bot in the Wild→