Diaries by Keyword - SANS Internet Storm Center

Watch ISC TV. Great for NOCs, SOCs and Living Rooms: https://isctv.sans.edu

Handler on Duty: Jesse La Grew

Threat Level: green

Date	Author	Title
PROCESS MONITOR
2009-09-19	Rick Wanner	Sysinternals Tools Updates
PROCESS
2023-11-09/a>	Xavier Mertens	Visual Examples of Code Injection
2023-08-26/a>	Xavier Mertens	macOS: Who?s Behind This Network Connection?
2023-05-24/a>	Jesse La Grew	More Data Enrichment for Cowrie Logs
2022-09-14/a>	Xavier Mertens	Easy Process Injection within Python
2022-03-15/a>	Xavier Mertens	Clean Binaries with Suspicious Behaviour
2021-05-30/a>	Didier Stevens	Sysinternals: Procmon, Sysmon, TcpView and Process Explorer update
2021-03-04/a>	Xavier Mertens	From VBS, PowerShell, C Sharp, Process Hollowing to RAT
2021-01-17/a>	Didier Stevens	New Release of Sysmon Adding Detection for Process Tampering
2020-02-16/a>	Guy Bruneau	SOAR or not to SOAR?
2019-06-27/a>	Rob VandenBrink	Finding the Gold in a Pile of Pennies - Long Tail Analysis in PowerShell
2018-09-20/a>	Xavier Mertens	Hunting for Suspicious Processes with OSSEC
2018-07-03/a>	Didier Stevens	Progress indication for scripts on Windows
2015-07-17/a>	Didier Stevens	Process Explorer and VirusTotal
2014-04-27/a>	Tony Carothers	The Dreaded "D" Word of IT
2014-02-27/a>	Richard Porter	DDoS and BCP 38
2014-02-10/a>	Rob VandenBrink	A Tale of Two Admins (and no Change Control)
2014-02-07/a>	Rob VandenBrink	Hello Virustotal? It's Microsoft Calling.
2013-02-06/a>	Adam Swanger	Sysinternals in particular Process Explorer update https://blogs.technet.com/b/sysinternals/?Redirected=true
2012-01-13/a>	Guy Bruneau	Sysinternals Updates - http://blogs.technet.com/b/sysinternals/archive/2012/01/13/updates-autoruns-v11-21-coreinfo-v3-03-portmon-v-3-03-process-explorer-v15-12-mark-s-blog-and-mark-at-rsa-2012.aspx
2011-12-19/a>	Guy Bruneau	Process Explorer Update 15.11 with bugfixes - http://technet.microsoft.com/en-us/sysinternals/bb896653
2010-01-23/a>	Lorna Hutcheson	The necessary evils: Policies, Processes and Procedures
2009-10-22/a>	Adrien de Beaupre	Cyber Security Awareness Month - Day 22 port 502 TCP - Modbus
2009-09-19/a>	Rick Wanner	Sysinternals Tools Updates
2009-08-30/a>	Tony Carothers	How do I recover from.....?
MONITOR
2022-12-20/a>	Xavier Mertens	Linux File System Monitoring & Actions
2020-03-15/a>	Guy Bruneau	VPN Access and Activity Monitoring
2019-10-16/a>	Xavier Mertens	Security Monitoring: At Network or Host Level?
2019-01-31/a>	Xavier Mertens	Tracking Unexpected DNS Changes
2017-06-17/a>	Guy Bruneau	Mapping Use Cases to Logs. Which Logs are the Most Important to Collect?
2017-04-20/a>	Xavier Mertens	DNS Query Length... Because Size Does Matter
2017-03-15/a>	Xavier Mertens	Retro Hunting!
2016-05-18/a>	Russ McRee	Resources: Windows Auditing & Monitoring, Linux 2FA
2016-03-30/a>	Xavier Mertens	What to watch with your FIM?
2015-12-12/a>	Russell Eubanks	What Signs Are You Missing?
2013-03-06/a>	Adam Swanger	IPv6 Focus Month: Guest Diary: Stephen Groat - Geolocation Using IPv6 Addresses
2012-09-02/a>	Lorna Hutcheson	Demonstrating the value of your Intrusion Detection Program and Analysts
2012-08-30/a>	Bojan Zdrnja	Analyzing outgoing network traffic (part 2)
2012-08-23/a>	Bojan Zdrnja	Analyzing outgoing network traffic
2011-10-17/a>	Rob VandenBrink	Critical Control 11: Account Monitoring and Control
2010-04-06/a>	Daniel Wesemann	Application Logs
2009-09-19/a>	Rick Wanner	Sysinternals Tools Updates
2008-06-07/a>	Jim Clausing	Followup to 'How do you monitor your website?'

PROCESS MONITOR

PROCESS

MONITOR