Author Archives: Xavier

[SANS ISC] Suspicious Domains Tracking Dashboard

Posted on by

I published the following diary on isc.sans.org: “Suspicious Domains Tracking Dashboard“. Domain names remain a gold mine to investigate security incidents or to prevent some malicious activity to occur on your network (example by using a DNS firewall). The ISC has also a page dedicated to domain names. But how

[The post [SANS ISC] Suspicious Domains Tracking Dashboard has been first published on /dev/random]

Continue reading [SANS ISC] Suspicious Domains Tracking Dashboard→

[SANS ISC] If you want something done right, do it yourself!

Posted on by

I published the following diary on isc.sans.org: “If you want something done right, do it yourself!“. Another day, another malicious document! I like to discover how the bad guys are creative to write new pieces of malicious code. Yesterday, I found another interesting sample. It’s always the same story, a

[The post [SANS ISC] If you want something done right, do it yourself! has been first published on /dev/random]

Continue reading [SANS ISC] If you want something done right, do it yourself!→

[SANS ISC] Keep An Eye on your Root Certificates

Posted on by

I published the following diary on isc.sans.org: “Keep An Eye on your Root Certificates“. A few times a year, we can read in the news that a rogue root certificate was installed without the user consent. The latest story that pops up in my mind is the Savitech audio drivers

[The post [SANS ISC] Keep An Eye on your Root Certificates has been first published on /dev/random]

Continue reading [SANS ISC] Keep An Eye on your Root Certificates→

[SANS ISC] Interesting VBA Dropper

Posted on by

I published the following diary on isc.sans.org: “Interesting VBA Dropper“. Here is another sample that I found in my spam trap. The technique to infect the victim’s computer is interesting. I captured a mail with a malicious RTF document (SHA256: c247929d3f5c82247db9102d2dec28c27f73dc0824f8b386f92aad1a22fd8edd) that exploits the OLE2Link vulnerability (CVE-2017-0199). Once opened, the

[The post [SANS ISC] Interesting VBA Dropper has been first published on /dev/random]

Continue reading [SANS ISC] Interesting VBA Dropper→

[SANS ISC] Simple Analysis of an Obfuscated JAR File

Posted on by

I published the following diary on isc.sans.org: “Simple Analysis of an Obfuscated JAR File“. Yesterday, I found in my spam trap a file named ‘0.19238000 1509447305.zip’ (SHA256: 7bddf3bf47293b4ad8ae64b8b770e0805402b487a4d025e31ef586e9a52add91). The ZIP archive contained a Java archive named ‘0.19238000 1509447305.jar’ (SHA256: b161c7c4b1e6750fce4ed381c0a6a2595a4d20c3b1bdb756a78b78ead0a92ce4). The file had a score of 0/61 in VT and

[The post [SANS ISC] Simple Analysis of an Obfuscated JAR File has been first published on /dev/random]

Continue reading [SANS ISC] Simple Analysis of an Obfuscated JAR File→

Splunk Custom Search Command: Searching for MISP IOC’s

Posted on by

While you use a tool every day, you get more and more knowledge about it but you also have plenty of ideas to improve it. I’m using Splunk on a daily basis within many customers’ environments as well as for personal purposes. When you have a big database of events,

[The post Splunk Custom Search Command: Searching for MISP IOC’s has been first published on /dev/random]

Continue reading Splunk Custom Search Command: Searching for MISP IOC’s→

[SANS ISC] Some Powershell Malicious Code

Posted on by

I published the following diary on isc.sans.org: “Some Powershell Malicious Code“. Powershell is a great language that can interact at a low-level with Microsoft Windows. While hunting, I found a nice piece of Powershell code. After some deeper checks, it appeared that the code was not brand new but it

[The post [SANS ISC] Some Powershell Malicious Code has been first published on /dev/random]

Continue reading [SANS ISC] Some Powershell Malicious Code→

“TorWitness” Docker Container: Automated (Tor) Websites Screenshots

Posted on by

The idea of this Docker container came after reading the excellent Micah Hoffman’s blog post: Dark Web Report + TorGhost + EyeWitness == Goodness. Like Micah, I’m also receiving a daily file with new websites discovered on the (dark|deep) web (name it as you prefer). This service is provided by @huncky

[The post “TorWitness” Docker Container: Automated (Tor) Websites Screenshots has been first published on /dev/random]

Continue reading “TorWitness” Docker Container: Automated (Tor) Websites Screenshots→

Automatic Extraction of Data from Excel Sheet

Posted on by

Excel sheets are very common files in corporate environments. It’s definitively not a security tool but it’s not rare to find useful information stored in such files. When these data must be processed for threat hunting or to collect IOC’s, it is mandatory to automate, as much as possible, the processing

[The post Automatic Extraction of Data from Excel Sheet has been first published on /dev/random]

Continue reading Automatic Extraction of Data from Excel Sheet→

[SANS ISC] Stop relying on file extensions

Posted on by

I published the following diary on isc.sans.org: “Stop relying on file extensions“. Yesterday, I found an interesting file in my spam trap. It was called ‘16509878451.XLAM’. To be honest, I was not aware of this extension and I found this on the web: “A file with the XLAM file extension is an

[The post [SANS ISC] Stop relying on file extensions has been first published on /dev/random]

Continue reading [SANS ISC] Stop relying on file extensions→