Author Archives: Xavier

[SANS ISC] Extending Hunting Capabilities in Your Network

Posted on by

I published the following diary on isc.sans.org: “Extending Hunting Capabilities in Your Network“: Today’s diary is an extension to the one I posted yesterday about hunting for malicious files crossing your network. Searching for new IOCs is nice but there are risks of missing important pieces of information! Indeed, the first

[The post [SANS ISC] Extending Hunting Capabilities in Your Network has been first published on /dev/random]

Continue reading [SANS ISC] Extending Hunting Capabilities in Your Network→

[SANS ISC] Automatic Hunting for Malicious Files Crossing your Network

Posted on by

I published the following diary on isc.sans.org: “Automatic Hunting for Malicious Files Crossing your Network“: If classic security controls remain mandatory (antivirus, IDS, etc), it is always useful to increase your capacity to detect suspicious activities occurring in your networks. Here is a quick recipe that I’m using to detect

[The post [SANS ISC] Automatic Hunting for Malicious Files Crossing your Network has been first published on /dev/random]

Continue reading [SANS ISC] Automatic Hunting for Malicious Files Crossing your Network→

[SANS ISC] Surge in blackmailing?

Posted on by

I published the following diary on isc.sans.org: “Surge in blackmailing?“: What’s happening with blackmails? For those who don’t know the word, it is a piece of mail sent to a victim to ask money in return for not revealing compromising information about him/her. For a few days, we noticed a peak

[The post [SANS ISC] Surge in blackmailing? has been first published on /dev/random]

Continue reading [SANS ISC] Surge in blackmailing?→

[SANS ISC] Administrator’s Password Bad Practice

Posted on by

I published the following diary on isc.sans.org: “Administrator’s Password Bad Practice“: Just a quick reminder about some bad practices while handling Windows Administrator credentials. I’m constantly changing my hunting filters on VT. A few days ago, I started to search for files/scripts that use the Microsoft SysInternals tool psexec. For system administrators,

[The post [SANS ISC] Administrator’s Password Bad Practice has been first published on /dev/random]

Continue reading [SANS ISC] Administrator’s Password Bad Practice→

TROOPERS 18 Wrap-Up Day #2

Posted on by

Hello Readers, here is my wrap-up of the second day. Usually, the second day is harder in the morning due to the social events but, at TROOPERS, they organize the hacker run started at 06:45 for the most motivated of us. Today, the topic of the 3rd track switched from

[The post TROOPERS 18 Wrap-Up Day #2 has been first published on /dev/random]

Continue reading TROOPERS 18 Wrap-Up Day #2→

TROOPERS 18 Wrap-Up Day #1

Posted on by

I’m back to Heidelberg (Germany) for my yearly trip to the TROOPERS conference. I really like this event and I’m glad to be able to attend it again (thanks to the crew!). So, here is my wrap-up for the first day. The conference organization remains the same with a good venue.

[The post TROOPERS 18 Wrap-Up Day #1 has been first published on /dev/random]

Continue reading TROOPERS 18 Wrap-Up Day #1→

[SANS ISC] Payload delivery via SMB

Posted on by

I published the following diary on isc.sans.org: “Payload delivery via SMB“: This weekend, while reviewing the collected data for the last days, I found an interesting way to drop a payload to the victim. This is not brand new and the attack surface is (in my humble opinion) very restricted

[The post [SANS ISC] Payload delivery via SMB has been first published on /dev/random]

Continue reading [SANS ISC] Payload delivery via SMB→

[SANS ISC] CRIMEB4NK IRC Bot

Posted on by

I published the following diary on isc.sans.org: “CRIMEB4NK IRC Bot“: Yesterday, I got my hands on the source code of an IRC bot written in Perl. Yes, IRC (“Internet Relay Chat”) is still alive! If the chat protocol is less used today to handle communications between malware and their C2 servers, it

[The post [SANS ISC] CRIMEB4NK IRC Bot has been first published on /dev/random]

Continue reading [SANS ISC] CRIMEB4NK IRC Bot→

SMBv1, The Phoenix of Protocols?

Posted on by

Everybody still reminds the huge impact that Wannacry had in many companies in 2017? The ransomware exploited the vulnerability, described in MS17-010, which abuse of the SMBv1 protocol. One of the requirements to protect against this kind of attacks was to simply disable SMBv1 (besides the fact to NOT expose

[The post SMBv1, The Phoenix of Protocols? has been first published on /dev/random]

Continue reading SMBv1, The Phoenix of Protocols?→

[SANS ISC] Malicious Bash Script with Multiple Features

Posted on by

I published the following diary on isc.sans.org: “Malicious Bash Script with Multiple Features“: It’s not common to find a complex malicious bash script. Usually, bash scripts are used to download a malicious executable and start it. This one has been spotted by @michalmalik who twitted about it. I had a

[The post [SANS ISC] Malicious Bash Script with Multiple Features has been first published on /dev/random]

Continue reading [SANS ISC] Malicious Bash Script with Multiple Features→