Author Archives: Xavier

[SANS ISC] Malicious script dropping an executable signed by Avast?

Posted on by

I published the following diary on isc.sans.org: “Malicious script dropping an executable signed by Avast?“. Yesterday, I found an interesting sample that I started to analyze… It reached my spam trap attached to an email in Portuguese with the subject: “Venho por meio desta solicitar orçamento dos produtos” (“I hereby

[The post [SANS ISC] Malicious script dropping an executable signed by Avast? has been first published on /dev/random]

Continue reading [SANS ISC] Malicious script dropping an executable signed by Avast?→

[SANS ISC] Defang all the things!

Posted on by

I published the following diary on isc.sans.org: “Defang all the things!“. Today, I would like to promote a best practice via a small Python module that is very helpful when you’re dealing with suspicious or malicious URLs. Links in documents are potentially dangerous because users can always click by mistake

[The post [SANS ISC] Defang all the things! has been first published on /dev/random]

Continue reading [SANS ISC] Defang all the things!→

Who’s Blocked by Bad Guys?

Posted on by

Just a quick post about an interesting file found in a phishing kit. Bad guys use common techniques to prevent crawlers, scanners or security companies from accessing their pages. Usually, they deploy a .htaccess file to achieve this. Today, I found a phishing kit related to a bank (ANZ) with such

[The post Who’s Blocked by Bad Guys? has been first published on /dev/random]

Continue reading Who’s Blocked by Bad Guys?→

[SANS ISC] Maldoc with auto-updated link

Posted on by

I published the following diary on isc.sans.org: “Maldoc with auto-updated link“. Yesterday, while hunting, I found another malicious document that (ab)used a Microsoft Word feature: auto-update of links. This feature is enabled by default for any newly created document (that was the case for my Word 2016 version). If you

[The post [SANS ISC] Maldoc with auto-updated link has been first published on /dev/random]

Continue reading [SANS ISC] Maldoc with auto-updated link→

[SANS ISC] Analysis of a Paypal phishing kit

Posted on by

I published the following diary on isc.sans.org: “Analysis of a Paypal phishing kit“. They are plenty of phishing kits in the wild that try to lure victims to provide their credentials. Services like Paypal are nice targets and we can find new fake pages almost daily. Sometimes, the web server isn’t

[The post [SANS ISC] Analysis of a Paypal phishing kit has been first published on /dev/random]

Continue reading [SANS ISC] Analysis of a Paypal phishing kit→

[SANS ISC] Increase of phpMyAdmin scans

Posted on by

I published the following diary on isc.sans.org: “Increase of phpMyAdmin scans“. PMA (or “phpMyAdmin”) is a well-known MySQL front-end written in PHP that “brings MySQL to the web” as stated on the web site. The tool is very popular amongst web developers because it helps to maintain databases just by using

[The post [SANS ISC] Increase of phpMyAdmin scans has been first published on /dev/random]

Continue reading [SANS ISC] Increase of phpMyAdmin scans→

Lazy BlackHat Presentations Crawler

Posted on by

Many infosec professionals joined Las Vegas to attend the BlackHat security conference. As I’m not part of those lucky people so I’m waiting for the presentations (they are published when the talk is completed). But I don’t have time to lose sitting in front of my computer and pressing F5… So let’s

[The post Lazy BlackHat Presentations Crawler has been first published on /dev/random]

Continue reading Lazy BlackHat Presentations Crawler→

[SANS ISC] TinyPot, My Small Honeypot

Posted on by

I published the following diary on isc.sans.org: “TinyPot, My Small Honeypot“. Running honeypots is always interesting to get an overview of what’s happening on the Internet in terms of scanners or new threats. Honeypots are useful not only in the Wild but also on your internal networks. There are plenty

[The post [SANS ISC] TinyPot, My Small Honeypot has been first published on /dev/random]

Continue reading [SANS ISC] TinyPot, My Small Honeypot→

[SANS ISC] Bots Searching for Keys & Config Files

Posted on by

I published the following diary on isc.sans.org: “Bots Searching for Keys & Config Files“. If you don’t know our “404” project, I would definitively recommend having a look at it! The idea is to track HTTP 404 errors returned by your web servers. I like to compare the value of 404 errors

[The post [SANS ISC] Bots Searching for Keys & Config Files has been first published on /dev/random]

Continue reading [SANS ISC] Bots Searching for Keys & Config Files→

[SANS ISC] Backup Scripts, the FIM of the Poor

Posted on by

I published the following diary on isc.sans.org: “Backup Scripts, the FIM of the Poor“. File Integrity Management or “FIM” is an interesting security control that can help to detect unusual changes in a file system. By example, on a server, they are directories that do not change often. Example with

[The post [SANS ISC] Backup Scripts, the FIM of the Poor has been first published on /dev/random]

Continue reading [SANS ISC] Backup Scripts, the FIM of the Poor→