Author Archives: Xavier

[SANS ISC Diary] Detecting Undisclosed Vulnerabilities with Security Tools & Features

Posted on by

I published the following diary on isc.sans.org: “Detecting Undisclosed Vulnerabilities with Security Tools & Features“. I’m a big fan of OSSEC. This tools is an open source HIDS and log management tool. Although often considered as the “SIEM of the poor”, it integrates a lot of interesting features and is fully configurable

[The post [SANS ISC Diary] Detecting Undisclosed Vulnerabilities with Security Tools & Features has been first published on /dev/random]

Continue reading [SANS ISC Diary] Detecting Undisclosed Vulnerabilities with Security Tools & Features→

[SANS ISC Diary] Quick Analysis of Data Left Available by Attackers

Posted on by

I published the following diary on isc.sans.org: “Quick Analysis of Data Left Available by Attackers“. While hunting for interesting cases, I found the following phishing email mimicking an UPS delivery notification… [Read more]

[The post [SANS ISC Diary] Quick Analysis of Data Left Available by Attackers has been first published on /dev/random]

Continue reading [SANS ISC Diary] Quick Analysis of Data Left Available by Attackers→

[SANS ISC Diary] IOC’s: Risks of False Positive Alerts Flood Ahead

Posted on by

I published the following diary on isc.sans.org: “IOC’s: Risks of False Positive Alerts Flood Ahead“. Yesterday, I wrote a blog post which explained how to interconnect a Cuckoo sandbox and the MISP sharing platform. MISP has a nice REST API that allows you to extract useful IOC’s in different formats.

[The post [SANS ISC Diary] IOC’s: Risks of False Positive Alerts Flood Ahead has been first published on /dev/random]

Continue reading [SANS ISC Diary] IOC’s: Risks of False Positive Alerts Flood Ahead→

Quick Integration of MISP and Cuckoo

Posted on by

With the number of attacks that we are facing today, defenders are looking for more and more IOC’s (“Indicator of Compromise) to feed their security solutions (firewalls, IDS, …). It becomes impossible to manage all those IOC’s manually and automation is the key. There are two main problems with this

[The post Quick Integration of MISP and Cuckoo has been first published on /dev/random]

Continue reading Quick Integration of MISP and Cuckoo→

[SANS ISC Diary] Malicious SVG Files in the Wild

Posted on by

I published the following diary on isc.sans.org: “Malicious SVG Files in the Wild“. In November 2016, the Facebook messenger application was used to deliver malicious SVG files to people [1]. SVG files (or “Scalable Vector Graphics”) are vector images that can be displayed in most modern browsers (natively or via

[The post [SANS ISC Diary] Malicious SVG Files in the Wild has been first published on /dev/random]

Continue reading [SANS ISC Diary] Malicious SVG Files in the Wild→

[SANS ISC Diary] Backup Files Are Good but Can Be Evil

Posted on by

I published the following diary on isc.sans.org: “Backup Files Are Good but Can Be Evil“. Since we started to work with computers, we always heard the following advice: “Make backups!”. Everytime you have to change something in a file or an application, first make a backup of the existing resources

[The post [SANS ISC Diary] Backup Files Are Good but Can Be Evil has been first published on /dev/random]

Continue reading [SANS ISC Diary] Backup Files Are Good but Can Be Evil→

[SANS ISC Diary] Who’s Attacking Me?

Posted on by

I published the following diary on isc.sans.org: “Who’s Attacking Me?“. I started to play with a nice reconnaissance tool that could be helpful in many cases – offensive as well as defensive. “IVRE” (“DRUNK” in French) is a tool developed by the CEA, the Alternative Energies and Atomic Energy Commission

[The post [SANS ISC Diary] Who’s Attacking Me? has been first published on /dev/random]

Continue reading [SANS ISC Diary] Who’s Attacking Me?→

[SANS ISC Diary] Using Security Tools to Compromize a Network

Posted on by

I published the following diary on isc.sans.org: “Using Security Tools to Compromize a Network“. One of our daily tasks is to assess and improve the security of our customers or colleagues. To achieve this use security tools (linked to processes). With the time, we are all building our personal toolbox

[The post [SANS ISC Diary] Using Security Tools to Compromize a Network has been first published on /dev/random]

Continue reading [SANS ISC Diary] Using Security Tools to Compromize a Network→

Using Monitor Resolution as Obfuscation Technique

Posted on by

A quick blog post about a malicious VBScript macro that I analysed… Bad guys have always plenty of ideas to obfuscate their code. The macro was delivered via a classic phishing email with an attached zip archive that contained a Windows .lnk file. The link containing a simple call to

[The post Using Monitor Resolution as Obfuscation Technique has been first published on /dev/random]

Continue reading Using Monitor Resolution as Obfuscation Technique→

[SANS ISC Diary] UAC Bypass in JScript Dropper

Posted on by

I published the following diary on isc.sans.org: “UAC Bypass in JScript Dropper“. Yesterday, one of our readers sent us a malicious piece of JScript: doc2016044457899656.pdf.js.js. It’s always interesting to have a look at samples coming from alternate sources because they may slightly differ from what we usually receive on a

[The post [SANS ISC Diary] UAC Bypass in JScript Dropper has been first published on /dev/random]

Continue reading [SANS ISC Diary] UAC Bypass in JScript Dropper→