Collaborate Disseminate
I published the following diary on isc.sans.org: “Ransomware as a Service“: Hunting on the dark web is interesting to find new malicious activities running in the background. Besides the classic sites where you can order drugs and all kind of counterfeited material, I discovered an interesting website which offers a
[The post [SANS ISC] Ransomware as a Service has been first published on /dev/random]
A security conference does not need to be “big” to be interesting. Size doesn’t matter with security conferences ;-). I’m in Lille, France where I attended the conference called “CoRIIN“. This event is held in French and means “Conférence sur la réponse aux incidents et l’investigation numérique” or “Incident Response
[The post CoRIIN 2018 Wrap-Up has been first published on /dev/random]
I published the following diary on isc.sans.org: “Comment your Packet Captures!“: When you are investigating a security incident, a key element is to take notes and to document as much as possible. There is no “best” way to take notes, some people use electronic solutions while others are using good
[The post [SANS ISC] Comment your Packet Captures! has been first published on /dev/random]
I published the following diary on isc.sans.org: “Mining or Nothing!“: Cryptocurrencies mining has been a trending attack for a few weeks. Our idling CPUs are now targeted by bad guys who are looked to generate some extra revenue by abusing our resources. Other fellow handlers already posted diaries about this topic.
[The post [SANS ISC] Mining or Nothing! has been first published on /dev/random]
I published the following diary on isc.sans.org: “2017, The Flood of CVEs“: 2017 is almost done and it’s my last diary for this year. I made a quick review of my CVE database (I’m using a local cve-search instance). The first interesting number is the amount of CVE’s created this
[The post [SANS ISC] 2017, The Flood of CVEs has been first published on /dev/random]
If you own a website, you already know that servers are visited all day long by bots and crawlers with multiple intents, sometimes good but also sometimes bad. An interesting field in web server logs is the “user-agent”. The RFC 2616 describes the User-Agent field used in HTTP requests: The
[The post Who’s That Bot? has been first published on /dev/random]
Who said that all computers are connected today? They are many classified environments where computers can simply never connect to the wild Internet. But sometimes, you need to install some pieces of software from online resources. The classic case is Python modules. Let’s take a practical example with the PyMISP which
[The post Installing Python Modules on Air-Gapped Hosts has been first published on /dev/random]
Continue reading Installing Python Modules on Air-Gapped Hosts
More a file format is used in a malware infection chain, more files of this type will be flagged as suspicious, analyzed or blocked by security controls. That’s why attackers are constantly looking for new ways to infect computers and use more exotic file formats. Like fashion is in a
[The post Malware Delivered via a Compiled HTML Help File has been first published on /dev/random]
Continue reading Malware Delivered via a Compiled HTML Help File
I published the following diary on isc.sans.org: “Example of ‘MouseOver’ Link in a Powerpoint File“: I really like Microsoft Office documents… They offer so many features that can be (ab)used to make them virtual bombs. Yesterday, I found a simple one but nicely prepared Powerpoint presentation: Payment_copy.ppsx (SHA256:7d6f3eb45c03a8c2fca4685e9f2d4e05c5fc564c3c81926a5305b6fa6808ac3f). It was still
[The post [SANS ISC] Example of ‘MouseOver’ Link in a Powerpoint File has been first published on /dev/random]
Continue reading [SANS ISC] Example of ‘MouseOver’ Link in a Powerpoint File
I published the following diary on isc.sans.org: “Microsoft Office VBA Macro Obfuscation via Metadata“: Often, malicious macros make use of the same functions to infect the victim’s computer. If a macro contains these strings, it can be flagged as malicious or, at least, considered as suspicious. Some examples of suspicious functions
[The post [SANS ISC] Microsoft Office VBA Macro Obfuscation via Metadata has been first published on /dev/random]
Continue reading [SANS ISC] Microsoft Office VBA Macro Obfuscation via Metadata