Petya? I hardly know ya! - an ISC update on the 2017-06-27 ransomware...
This is a follow-up the our previous diary on the ransomware outbreak that happened yesterday on Tuesday 2017-06-27. Introduction By now, it seems almost everyone has written something about yesterdays...
View ArticleISC Stormcast For Thursday, June 29th 2017...
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
View ArticleCatching up with Blank Slate: a malspam campaign still going strong, (Wed,...
Introduction Blank Slate is the nickname for a malicious spam (malspam) campaign pushing ransomware targeting Windows hosts. Ive already discussed this campaign in a previous diary back in March 2017....
View ArticleISC Stormcast For Friday, June 30th 2017...
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
View ArticleUsing nmap to scan for MS17-010 (CVE-2017-0143 EternalBlue), (Sat, Jul 1st)
With both WannaCry and NotPetya using MS17-010 for propagation it is important to be able to detect servers which are vulnerable. Even if you have comprehensive vulnerability management and patching...
View ArticlePE Section Name Descriptions, (Sun, Jul 2nd)
PE files (.exe, .dll, ...) have sections: a section with code, one with data, ... Each section has a name, and different compilers use different section names. Section names can help us identify the...
View ArticleISC Stormcast For Wednesday, July 5th 2017...
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
View ArticleSelecting domains with random names, (Wed, Jul 5th)
I often have to go through lists of domains or URLs, and filter out domains that look like random strings of characters (and could thus have been generated by malware using an algorithm). Thats one of...
View ArticleISC Stormcast For Thursday, July 6th 2017...
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
View ArticleInvestigation of BitTorrent Sync (v.2.0) as a P2P Cloud Service (Part 2 ? Log...
[This is a second guest diary by Dr. this post discusses evidencethat can be extracted from related log files of BitTorrent Sync version 2.0 on Windows 8.1, Mac OS X Mavericks 10.9.5, and Ubuntu...
View ArticleISC Stormcast For Friday, July 7th 2017...
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
View ArticleDDoS Extortion E-mail: Yet Another Bluff?, (Fri, Jul 7th)
And DDoS extortion campaigns continue to be reported. Two weeks ago, Johannes Ullrich published a diary [1] about a fake DDoS pretending to be sent from Anonymous, threatening the targeted company with...
View ArticleA VBScript with Obfuscated Base64 Data, (Sat, Jul 8th)
A few months ago, I posted a diary to explain how to search for (malicious) PE files in Base64 data[1]. Base64 is indeed a common way to distribute binary content in an ASCII form. There are plenty of...
View ArticleClik here to view.
Adversary hunting with SOF-ELK, (Sun, Jul 9th)
As we recently celebrated Independence Day in the U.S., Im reminded that we honor what was, of course, an armed conflict. Todays realities, when we think about conflict, are quite different than the...
View ArticleISC Stormcast For Monday, July 10th 2017...
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
View ArticleISC Stormcast For Tuesday, July 11th 2017...
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
View ArticleBasic Office maldoc analysis, (Mon, Jul 10th)
Malicious Office documents come in all type of flavors, sometimes very simple: they contain just an embedded file (for example an EXE), without any script or exploit to automatically launch the...
View ArticleISC Stormcast For Wednesday, July 12th 2017...
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
View ArticleJuly's Microsoft Patch Tuesday, (Tue, Jul 11th)
TodaysMicrosoft Patch Tuesdayfixes critical and important flaws that, if exploited, could give an attacker a range of possibilities - from privilege escalation to remote code execution (RCE) - on...
View ArticleBackup Scripts, the FIM of the Poor, (Wed, Jul 12th)
File Integrity Management or FIM is an interesting security control that can help to detect unusual changes in a file system. By example, on a server, they are directories that do not change often....
View Article