[This is a Guest Diary by Joshua Tyrrell, an ISC intern as part of the SANS.edu BACS program] Managing the Attack Surface You’ve begun the journey of reviewing your IT infrastructure and attempting to figure out how to protect...
Read More
I like to enrich my honeypot data from a variety of sources to help understand a bit more about...
Read MoreIt has been a while since I started to track how Python is used in the Windows eco-system[1]. Almost every day I find new pieces of malicious Python scripts. The programming language itself is not malicious. There are plenty of...
Read More
While trying to process some of my honeypot data, I ran into the following error in my Python...
Read More
For a whille now, I have seen scans that contain the pattern “%%target%%” in the URL....
Read More![Mapping Threats with DNSTwist and the Internet Storm Center [Guest Diary], (Tue, Aug 20th)](https://b923496.smushcdn.com/923496/wp-content/uploads/2024/08/Michael_Tigges_Picture1-627x376.png?lossy=1&strip=1&webp=1)
[This is a Guest Diary by Michael Tigges, an ISC intern as part of the SANS.edu BACS program] On...
Read MoreI recorded a quick live stream with a quick update on CVE-2024-38063. The video focuses on determining the exploitability, particularly whether your systems are reachable by IPv6. After recording this video, Stephen Sims pointed...
Read More
I found a tiny .bat file that looked not suspicious at all: 3650.bat...
Read More![[Guest Diary] 7 minutes and 4 steps to a quick win: A write-up on custom tools, (Fri, Aug 16th)](https://b923496.smushcdn.com/923496/wp-content/uploads/2024/08/2024-08-16_figure1_2.png?lossy=1&strip=1&webp=1)
[This is a Guest Diary by Justin Leibach, an ISC intern as a part of the SANS.edu BACS [1] degree...
Read More
In diary entry “A Wireshark Lua Dissector for Fixed Field Length Protocols”, I show...
Read More
One of my hunting rules hit on potentially malicious PowerShell code. The file was an MSI package...
Read MoreThis month we got patches for 186 vulnerabilities. Of these, 9 are critical, and 9 are zero-days (3 previously disclosed, and 6 are already being exploited). The CVEs CVE-2024-38189, CVE-2024-38178, CVE-2024-38193,...
Read More