Internet Storm Center
Sign In
Sign Up
Participate: Learn more about our honeypot network
https://isc.sans.edu/tools/honeypot/
Handler on Duty:
Didier Stevens
Threat Level:
green
Date
Author
Title
FLASHBACK G
2012-02-24
Guy Bruneau
Flashback Trojan in the Wild
FLASHBACK
2012-04-14/a>
Rick Wanner
Flashback Trojan Removal Tool Released
2012-04-12/a>
Guy Bruneau
Apple Java Updates for Mac OS X
2012-03-05/a>
Johannes Ullrich
Flashback Malware now with Twitter C&C
2012-02-24/a>
Guy Bruneau
Flashback Trojan in the Wild
G
2023-01-21/a>
Guy Bruneau
DShield Sensor JSON Log to Elasticsearch
2023-01-17/a>
Rob VandenBrink
Finding that one GPO Setting in a Pool of Hundreds of GPOs
2023-01-16/a>
Johannes Ullrich
PSA: Why you must run an ad blocker when using Google
2023-01-12/a>
Russ McRee
Prowler v3: AWS & Azure security assessments
2023-01-08/a>
Guy Bruneau
DShield Sensor JSON Log Analysis
2023-01-05/a>
Brad Duncan
More Brazil malspam pushing Astaroth (Guildma) in January 2023
2022-12-22/a>
Guy Bruneau
Exchange OWASSRF Exploited for Remote Code Execution
2022-12-21/a>
Guy Bruneau
DShield Sensor Setup in Azure
2022-12-20/a>
Xavier Mertens
Linux File System Monitoring & Actions
2022-12-19/a>
Xavier Mertens
Hunting for Mastodon Servers
2022-12-10/a>
Didier Stevens
Open Now: 2022 SANS Holiday Hack Challenge & KringleCon
2022-12-04/a>
Didier Stevens
Finger.exe LOLBin
2022-12-02/a>
Brad Duncan
obama224 distribution Qakbot tries .vhd (virtual hard disk) images
2022-11-24/a>
Xavier Mertens
Attackers Keep Phishing Victims Under Stress
2022-11-19/a>
Guy Bruneau
McAfee Fake Antivirus Phishing Campaign is Back!
2022-11-10/a>
Xavier Mertens
Do you collect "Observables" or "IOCs"?
2022-10-27/a>
Tom Webb
Supersizing your DUO and 365 Integration
2022-10-23/a>
Didier Stevens
Video: PNG Analysis
2022-10-22/a>
Didier Stevens
rtfdump's Find Option
2022-10-16/a>
Didier Stevens
Video: Analysis of a Malicious HTML File (QBot)
2022-10-15/a>
Guy Bruneau
Malware - Covid Vaccination Supplier Declaration
2022-10-13/a>
Didier Stevens
Analysis of a Malicious HTML File (QBot)
2022-10-07/a>
Xavier Mertens
Powershell Backdoor with DGA Capability
2022-10-07/a>
Xavier Mertens
Critical Fortinet Vulnerability Ahead
2022-10-04/a>
Johannes Ullrich
Credential Harvesting with Telegram API
2022-09-29/a>
Didier Stevens
PNG Analysis
2022-09-21/a>
Xavier Mertens
Phishing Campaigns Use Free Online Resources
2022-09-18/a>
Didier Stevens
Video: Grep & Tail -f With Notepad++
2022-09-10/a>
Guy Bruneau
Phishing Word Documents with Suspicious URL
2022-09-05/a>
Didier Stevens
Quickie: Grep & Tail -f With Notepad++
2022-09-03/a>
Didier Stevens
Video: James Webb JPEG With Malware
2022-09-02/a>
Didier Stevens
James Webb JPEG With Malware
2022-09-01/a>
Johannes Ullrich
Jolokia Scans: Possible Hunt for Vulnerable Apache Geode Servers (CVE-2022-37021)
2022-08-26/a>
Xavier Mertens
Paypal Phishing/Coinbase in One Image
2022-08-26/a>
Guy Bruneau
HTTP/2 Packet Analysis with Wireshark
2022-08-23/a>
Xavier Mertens
Who's Looking at Your security.txt File?
2022-08-19/a>
Brad Duncan
Brazil malspam pushes Astaroth (Guildma) malware
2022-08-14/a>
Johannes Ullrich
Realtek SDK SIP ALG Vulnerability: A Big Deal, but not much you can do about it. CVE 2022-27255
2022-08-13/a>
Guy Bruneau
Phishing HTML Attachment as Voicemail Audio Transcription
2022-07-28/a>
Johannes Ullrich
Exfiltrating Data With Bookmarks
2022-07-23/a>
Guy Bruneau
Analysis of SSH Honeypot Data with PowerBI
2022-07-22/a>
Yee Ching Tok
An Analysis of a Discerning Phishing Website
2022-07-20/a>
Xavier Mertens
Malicious Python Script Behaving Like a Rubber Ducky
2022-07-20/a>
Johannes Ullrich
Apple Patches Everything Day
2022-07-13/a>
Xavier Mertens
Using Referers to Detect Phishing Attacks
2022-07-09/a>
Didier Stevens
7-Zip Editing & MoW
2022-07-08/a>
Johannes Ullrich
ISC Website Redesign
2022-06-24/a>
Xavier Mertens
Python (ab)using The Windows GUI
2022-06-23/a>
Xavier Mertens
FLOSS 2.0 Has Been Released
2022-06-02/a>
Johannes Ullrich
Quick Answers in Incident Response: RECmd.exe
2022-06-01/a>
Jan Kopriva
HTML phishing attachments - now with anti-analysis features
2022-05-29/a>
Didier Stevens
Extracting The Overlay Of A PE File
2022-05-28/a>
Didier Stevens
Huge Signed PE File: Keeping The Signature
2022-05-26/a>
Didier Stevens
Huge Signed PE File
2022-05-18/a>
Jan Kopriva
Do you want 30 BTC? Nothing is easier (or cheaper) in this phishing campaign...
2022-05-14/a>
Didier Stevens
Quick Analysis Of Phishing MSG
2022-05-13/a>
Johannes Ullrich
From 0-Day to Mirai: 7 days of BIG-IP Exploits
2022-05-08/a>
Johannes Ullrich
F5 BIG-IP Unauthenticated RCE Vulnerability (CVE-2022-1388)
2022-05-07/a>
Guy Bruneau
Phishing PDF Received in my ISC Mailbox
2022-04-25/a>
Xavier Mertens
Simple PDF Linking to Malicious Content
2022-04-24/a>
Didier Stevens
Analyzing a Phishing Word Document
2022-04-23/a>
Guy Bruneau
Are Roku Streaming Devices Safe from Exploitation?
2022-04-19/a>
Johannes Ullrich
Resetting Linux Passwords with U-Boot Bootloaders
2022-04-11/a>
Johannes Ullrich
Spring: It isn't just about Spring4Shell. Spring Cloud Function Vulnerabilities are being probed too.
2022-04-10/a>
Didier Stevens
Video: Method For String Extraction Filtering
2022-04-09/a>
Didier Stevens
Method For String Extraction Filtering
2022-04-07/a>
Johannes Ullrich
What is BIMI and how is it supposed to help with Phishing.
2022-04-05/a>
Johannes Ullrich
WebLogic Crypto Miner Malware Disabling Alibaba Cloud Monitoring Tools
2022-04-04/a>
Johannes Ullrich
Emptying the Phishtank: Are WordPress sites the Mosquitoes of the Internet?
2022-03-31/a>
Johannes Ullrich
Spring Vulnerability Update - Exploitation Attempts CVE-2022-22965
2022-03-30/a>
Johannes Ullrich
Possible new Java Spring Framework Vulnerability (Updated: not a Spring problem)
2022-03-30/a>
Johannes Ullrich
Java Springtime Confusion: What Vulnerability are We Talking About
2022-03-29/a>
Johannes Ullrich
More Fake/Typosquatting Twitter Accounts Asking for Ukraine Crytocurrency Donations
2022-03-24/a>
Xavier Mertens
Malware Delivered Through Free Sharing Tool
2022-03-15/a>
Xavier Mertens
Clean Binaries with Suspicious Behaviour
2022-03-02/a>
Johannes Ullrich
The More Often Something is Repeated, the More True It Becomes: Dealing with Social Media
2022-02-23/a>
Johannes Ullrich
The Rise and Fall of log4shell
2022-02-18/a>
Xavier Mertens
Remcos RAT Delivered Through Double Compressed Archive
2022-02-16/a>
Brad Duncan
Astaroth (Guildma) infection
2022-02-13/a>
Guy Bruneau
DHL Spear Phishing to Capture Username/Password
2022-02-05/a>
Didier Stevens
Power over Ethernet and Thermal Imaging
2022-02-01/a>
Xavier Mertens
Automation is Nice But Don't Replace Your Knowledge
2022-01-31/a>
Xavier Mertens
Be careful with RPMSG files
2022-01-29/a>
Guy Bruneau
SIEM In this Decade, Are They Better than the Last?
2022-01-28/a>
Xavier Mertens
Malicious ISO Embedded in an HTML Page
2022-01-18/a>
Jan Kopriva
Phishing e-mail with...an advertisement?
2022-01-17/a>
Johannes Ullrich
Log4Shell Attacks Getting "Smarter"
2022-01-06/a>
Xavier Mertens
Malicious Python Script Targeting Chinese People
2022-01-03/a>
Xavier Mertens
McAfee Phishing Campaign with a Nice Fake Scan
2022-01-02/a>
Guy Bruneau
Exchange Server - Email Trapped in Transport Queues
2022-01-01/a>
Didier Stevens
Expect Regressions
2021-12-31/a>
Jan Kopriva
Do you want your Agent Tesla in the 300 MB or 8 kB package?
2021-12-30/a>
Brad Duncan
Agent Tesla Updates SMTP Data Exfiltration Technique
2021-12-29/a>
Russ McRee
Log4j 2 Security Vulnerabilities Update Guide
2021-12-28/a>
Russ McRee
LotL Classifier tests for shells, exfil, and miners
2021-12-23/a>
Johannes Ullrich
log4shell and cloud provider internal meta data services (IMDS)
2021-12-23/a>
Johannes Ullrich
Defending Cloud IMDS Against log4shell (and more)
2021-12-23/a>
Xavier Mertens
Nicely Crafted indeed.com Login Page
2021-12-22/a>
Brad Duncan
December 2021 Forensic Contest: Answers and Analysis
2021-12-21/a>
Xavier Mertens
More Undetected PowerShell Dropper
2021-12-20/a>
Jan Kopriva
PowerPoint attachments, Agent Tesla and code reuse in malware
2021-12-16/a>
Brad Duncan
How the "Contact Forms" campaign tricks people
2021-12-14/a>
Johannes Ullrich
Log4j: Getting ready for the long haul (CVE-2021-44228)
2021-12-11/a>
Johannes Ullrich
Log4j / Log4Shell Followup: What we see and how to defend (and how to access our data)
2021-12-10/a>
Bojan Zdrnja
RCE in log4j, Log4Shell, or how things can get bad quickly
2021-12-09/a>
Yee Ching Tok
Phishing Direct Messages via Discord
2021-12-08/a>
Brad Duncan
December 2021 Forensic Challenge
2021-12-06/a>
Xavier Mertens
The Importance of Out-of-Band Networks
2021-12-04/a>
Guy Bruneau
A Review of Year 2021
2021-11-25/a>
Didier Stevens
YARA's Private Strings
2021-11-24/a>
Jan Kopriva
Phishing page hiding itself using dynamically adjusted IP-based allow list
2021-11-18/a>
Xavier Mertens
JavaScript Downloader Delivers Agent Tesla Trojan
2021-11-15/a>
Rob VandenBrink
Changing your AD Password Using the Clipboard - Not as Easy as You'd Think!
2021-11-10/a>
Xavier Mertens
Shadow IT Makes People More Vulnerable to Phishing
2021-11-04/a>
Tom Webb
Xmount for Disk Images
2021-10-30/a>
Guy Bruneau
Remote Desktop Protocol (RDP) Discovery
2021-10-26/a>
Yee Ching Tok
Hunting for Phishing Sites Masquerading as Outlook Web Access
2021-10-21/a>
Brad Duncan
"Stolen Images Evidence" campaign pushes Sliver-based malware
2021-10-14/a>
Xavier Mertens
Port-Forwarding with Windows for the Win
2021-10-13/a>
Johannes Ullrich
Please fix your E-Mail Brute forcing tool!
2021-10-11/a>
Johannes Ullrich
Things that go "Bump" in the Night: Non HTTP Requests Hitting Web Servers
2021-10-09/a>
Guy Bruneau
Scanning for Previous Oracle WebLogic Vulnerabilities
2021-10-04/a>
Johannes Ullrich
Facebook Outage: Yes, its DNS (sort of). A super quick analysis of what is going on.
2021-09-29/a>
Yee Ching Tok
Keeping Track of Time: Network Time Protocol and a GPSD Bug
2021-09-25/a>
Didier Stevens
Strings Analysis: VBA & Excel4 Maldoc
2021-09-25/a>
Didier Stevens
Video: Strings Analysis: VBA & Excel4 Maldoc
2021-09-24/a>
Xavier Mertens
Keep an Eye on Your Users Mobile Devices (Simple Inventory)
2021-09-20/a>
Johannes Ullrich
#OMIGOD Exploits Captured in the Wild. Researchers responsible for half of scans for related ports.
2021-09-16/a>
Jan Kopriva
Phishing 101: why depend on one suspicious message subject when you can use many?
2021-09-15/a>
Brad Duncan
Hancitor campaign abusing Microsoft's OneDrive
2021-09-11/a>
Guy Bruneau
Shipping to Elasticsearch Microsoft DNS Logs
2021-09-02/a>
Xavier Mertens
Attackers Will Always Abuse Major Events in our Lifes
2021-08-24/a>
Johannes Ullrich
Attackers Hunting For Twilio Credentials
2021-08-20/a>
Xavier Mertens
Waiting for the C2 to Show Up
2021-08-19/a>
Johannes Ullrich
When Lightning Strikes. What works and doesn't work.
2021-08-17/a>
Johannes Ullrich
Laravel (<=v8.4.2) exploit attempts for CVE-2021-3129 (debug mode: Remote code execution)
2021-08-13/a>
Guy Bruneau
Scanning for Microsoft Exchange eDiscovery
2021-08-04/a>
Yee Ching Tok
Pivoting and Hunting for Shenanigans from a Reported Phishing Domain
2021-08-03/a>
Johannes Ullrich
Is this the Weirdest Phishing (SMishing?) Attempt Ever?
2021-07-30/a>
Xavier Mertens
Infected With a .reg File
2021-07-29/a>
Xavier Mertens
Malicious Content Delivered Through archive.org
2021-07-28/a>
Jan Kopriva
A sextortion e-mail from...IT support?!
2021-07-24/a>
Xavier Mertens
Agent.Tesla Dropped via a .daa Image and Talking to Telegram
2021-07-16/a>
Xavier Mertens
Multiple BaseXX Obfuscations
2021-07-14/a>
Jan Kopriva
One way to fail at malspam - give recipients the wrong password for an encrypted attachment
2021-07-13/a>
Johannes Ullrich
USPS Phishing Using Telegram to Collect Data
2021-07-10/a>
Guy Bruneau
Scanning for Microsoft Secure Socket Tunneling Protocol
2021-07-08/a>
Xavier Mertens
Using Sudo with Python For More Security Controls
2021-07-06/a>
Xavier Mertens
Python DLL Injection Check
2021-07-03/a>
Didier Stevens
Finding Strings With oledump.py
2021-06-30/a>
Johannes Ullrich
CVE-2021-1675: Incomplete Patch and Leaked RCE Exploit
2021-06-30/a>
Brad Duncan
June 2021 Forensic Contest: Answers and Analysis
2021-06-28/a>
Didier Stevens
CFBF Files Strings Analysis
2021-06-26/a>
Guy Bruneau
CVE-2019-9670: Zimbra Collaboration Suite XXE vulnerability
2021-06-22/a>
Jan Kopriva
Phishing asking recipients not to report abuse
2021-06-18/a>
Daniel Wesemann
Network Forensics on Azure VMs (Part #2)
2021-06-18/a>
Daniel Wesemann
Open redirects ... and why Phishers love them
2021-06-12/a>
Guy Bruneau
Fortinet Targeted for Unpatched SSL VPN Discovery Activity
2021-06-11/a>
Xavier Mertens
Keeping an Eye on Dangerous Python Modules
2021-06-04/a>
Xavier Mertens
Russian Dolls VBS Obfuscation
2021-05-29/a>
Guy Bruneau
Spear-phishing Email Targeting Outlook Mail Clients
2021-05-28/a>
Xavier Mertens
Malicious PowerShell Hosted on script.google.com
2021-05-27/a>
Jan Kopriva
All your Base are...nearly equal when it comes to AV evasion, but 64-bit executables are not
2021-05-22/a>
Xavier Mertens
"Serverless" Phishing Campaign
2021-05-21/a>
Xavier Mertens
Locking Kernel32.dll As Anti-Debugging Technique
2021-05-08/a>
Guy Bruneau
Who is Probing the Internet for Research Purposes?
2021-05-07/a>
Daniel Wesemann
Exposed Azure Storage Containers
2021-05-06/a>
Xavier Mertens
Alternative Ways To Perform Basic Tasks
2021-05-02/a>
Didier Stevens
PuTTY And FileZilla Use The Same Fingerprint Registry Keys
2021-04-30/a>
Remco Verhoef
Qiling: A true instrumentable binary emulation framework
2021-04-26/a>
Didier Stevens
CAD: .DGN and .MVBA Files
2021-04-24/a>
Guy Bruneau
Base64 Hashes Used in Web Scanning
2021-04-22/a>
Xavier Mertens
How Safe Are Your Docker Images?
2021-04-19/a>
Jan Kopriva
Hunting phishing websites with favicon hashes
2021-04-10/a>
Guy Bruneau
Building an IDS Sensor with Suricata & Zeek with Logs to ELK
2021-03-18/a>
Xavier Mertens
Simple Python Keylogger
2021-03-17/a>
Xavier Mertens
Defenders, Know Your Operating System Like Attackers Do!
2021-03-12/a>
Guy Bruneau
Microsoft DHCP Logs Shipped to ELK
2021-03-11/a>
Johannes Ullrich
Piktochart - Phishing with Infographics
2021-03-04/a>
Xavier Mertens
From VBS, PowerShell, C Sharp, Process Hollowing to RAT
2021-03-03/a>
Johannes Ullrich
Microsoft Releases Exchange Emergency Patch to Fix Actively Exploited Vulnerability
2021-02-26/a>
Guy Bruneau
Pretending to be an Outlook Version Update
2021-02-24/a>
Brad Duncan
Malspam pushes GuLoader for Remcos RAT
2021-02-17/a>
Xavier Mertens
The new "LinkedInSecureMessage" ?
2021-02-13/a>
Guy Bruneau
Using Logstash to Parse IPtables Firewall Logs
2021-02-12/a>
Xavier Mertens
AgentTesla Dropped Through Automatic Click in Microsoft Help File
2021-02-11/a>
Jan Kopriva
Agent Tesla hidden in a historical anti-malware tool
2021-02-10/a>
Brad Duncan
Phishing message to the ISC handlers email distro
2021-01-30/a>
Guy Bruneau
PacketSifter as Network Parsing and Telemetry Tool
2021-01-30/a>
Guy Bruneau
Wireshark 3.2.11 is now available which contains Bug Fixes - https://www.wireshark.org
2021-01-19/a>
Russ McRee
Gordon for fast cyber reputation checks
2021-01-17/a>
Didier Stevens
New Release of Sysmon Adding Detection for Process Tampering
2021-01-15/a>
Brad Duncan
Throwback Friday: An Example of Rig Exploit Kit
2021-01-10/a>
Didier Stevens
Maldoc Analysis With CyberChef
2021-01-09/a>
Didier Stevens
Maldoc Strings Analysis
2021-01-05/a>
Johannes Ullrich
Netfox Detective: An Alternative Open-Source Packet Analysis Tool
2021-01-01/a>
Didier Stevens
Strings 2021
2020-12-26/a>
Didier Stevens
base64dump.py Supported Encodings
2020-12-22/a>
Xavier Mertens
Malware Victim Selection Through WiFi Identification
2020-12-14/a>
Johannes Ullrich
SolarWinds Breach Used to Infiltrate Customer Networks (Solarigate)
2020-12-13/a>
Didier Stevens
KringleCon 2020
2020-12-10/a>
Xavier Mertens
Python Backdoor Talking to a C2 Through Ngrok
2020-12-08/a>
Johannes Ullrich
December 2020 Microsoft Patch Tuesday: Exchange, Sharepoint, Dynamics and DNS Spoofing
2020-12-05/a>
Guy Bruneau
Is IP 91.199.118.137 testing Access to aahwwx.52host.xyz?
2020-12-04/a>
Guy Bruneau
Detecting Actors Activity with Threat Intel
2020-11-12/a>
Daniel Wesemann
Exposed Blob Storage in Azure
2020-11-12/a>
Daniel Wesemann
Preventing Exposed Azure Blob Storage
2020-11-07/a>
Guy Bruneau
Cryptojacking Targeting WebLogic TCP/7001
2020-11-06/a>
Johannes Ullrich
Rediscovering Limitations of Stateful Firewalls: "NAT Slipstreaming" ? Implications, Detections and Mitigations
2020-10-29/a>
Johannes Ullrich
PATCH NOW: CVE-2020-14882 Weblogic Actively Exploited Against Honeypots
2020-10-28/a>
Jan Kopriva
SMBGhost - the critical vulnerability many seem to have forgotten to patch
2020-10-25/a>
Didier Stevens
Video: Pascal Strings
2020-10-24/a>
Guy Bruneau
An Alternative to Shodan, Censys with User-Agent CensysInspect/1.1
2020-10-22/a>
Jan Kopriva
BazarLoader phishing lures: plan a Halloween party, get a bonus and be fired in the same afternoon
2020-10-21/a>
Daniel Wesemann
Shipping dangerous goods
2020-10-12/a>
Didier Stevens
Nested .MSGs: Turtles All The Way Down
2020-10-11/a>
Didier Stevens
Analyzing MSG Files With plugin_msg_summary
2020-10-09/a>
Jan Kopriva
Phishing kits as far as the eye can see
2020-10-03/a>
Guy Bruneau
Scanning for SOHO Routers
2020-10-02/a>
Xavier Mertens
Analysis of a Phishing Kit
2020-10-01/a>
Daniel Wesemann
Making sense of Azure AD (AAD) activity logs
2020-09-28/a>
Xavier Mertens
Some Tyler Technologies Customers Targeted with The Installation of a Bomgar Client
2020-09-24/a>
Xavier Mertens
Party in Ibiza with PowerShell
2020-09-21/a>
Jan Kopriva
Slightly broken overlay phishing
2020-09-20/a>
Guy Bruneau
Analysis of a Salesforce Phishing Emails
2020-09-09/a>
Johannes Ullrich
A First Look at macOS 11 Big Sur Network Traffic (New! Now with more GREASE!)
2020-08-30/a>
Johannes Ullrich
CenturyLink Outage Causing Internet Wide Problems
2020-08-25/a>
Xavier Mertens
Keep An Eye on LOLBins
2020-08-24/a>
Xavier Mertens
Tracking A Malware Campaign Through VT
2020-08-22/a>
Guy Bruneau
Remote Desktop (TCP/3389) and Telnet (TCP/23), What might they have in Common?
2020-08-20/a>
Rob VandenBrink
Office 365 Mail Forwarding Rules (and other Mail Rules too)
2020-08-14/a>
Jan Kopriva
Definition of 'overkill' - using 130 MB executable to hide 24 kB malware
2020-08-10/a>
Bojan Zdrnja
Scoping web application and web service penetration tests
2020-08-08/a>
Guy Bruneau
Scanning Activity Include Netcat Listener
2020-08-03/a>
Johannes Ullrich
A Word of Caution: Helping Out People Being Stalked Online
2020-08-02/a>
Didier Stevens
Small Challenge: A Simple Word Maldoc
2020-07-27/a>
Johannes Ullrich
In Memory of Donald Smith
2020-07-26/a>
Didier Stevens
Cracking Maldoc VBA Project Passwords
2020-07-23/a>
Xavier Mertens
Simple Blocklisting with MISP & pfSense
2020-07-19/a>
Guy Bruneau
Scanning Activity for ZeroShell Unauthenticated Access
2020-07-16/a>
John Bambenek
Hunting for SigRed Exploitation
2020-07-15/a>
Johannes Ullrich
PATCH NOW - SIGRed - CVE-2020-1350 - Microsoft DNS Server Vulnerability
2020-07-12/a>
Didier Stevens
Maldoc: VBA Purging Example
2020-07-11/a>
Guy Bruneau
VMware XPC Client validation privilege escalation vulnerability - https://www.vmware.com/security/advisories/VMSA-2020-0017.html
2020-07-11/a>
Guy Bruneau
Scanning Home Internet Facing Devices to Exploit
2020-07-06/a>
Johannes Ullrich
Summary of CVE-2020-5902 F5 BIG-IP RCE Vulnerability Exploits
2020-07-05/a>
Didier Stevens
CVE-2020-5902 F5 BIG-IP Exploitation Attempt
2020-07-04/a>
Russ McRee
Happy FouRth of July from the Internet Storm Center
2020-06-19/a>
Remco Verhoef
Sigma rules! The generic signature format for SIEM systems.
2020-06-18/a>
Jan Kopriva
Broken phishing accidentally exploiting Outlook zero-day
2020-06-15/a>
Rick Wanner
HTML based Phishing Run
2020-06-13/a>
Guy Bruneau
Mirai Botnet Activity
2020-06-11/a>
Xavier Mertens
Anti-Debugging JavaScript Techniques
2020-06-08/a>
Didier Stevens
Translating BASE64 Obfuscated Scripts
2020-06-04/a>
Xavier Mertens
Anti-Debugging Technique based on Memory Protection
2020-06-01/a>
Jim Clausing
Stackstrings, type 2
2020-05-29/a>
Johannes Ullrich
The Impact of Researchers on Our Data
2020-05-27/a>
Jan Kopriva
Frankenstein's phishing using Google Cloud Storage
2020-05-23/a>
Xavier Mertens
AgentTesla Delivered via a Malicious PowerPoint Add-In
2020-05-22/a>
Didier Stevens
Some Strings to Remember
2020-05-21/a>
Xavier Mertens
Malware Triage with FLOSS: API Calls Based Behavior
2020-05-16/a>
Guy Bruneau
Scanning for Outlook Web Access (OWA) & Microsoft Exchange Control Panel (ECP)
2020-05-14/a>
Rob VandenBrink
Patch Tuesday Revisited - CVE-2020-1048 isn't as "Medium" as MS Would Have You Believe
2020-05-06/a>
Xavier Mertens
Keeping an Eye on Malicious Files Life Time
2020-05-05/a>
Russ McRee
Cloud Security Features Don't Replace the Need for Personnel Security Capabilities
2020-05-02/a>
Guy Bruneau
Phishing PDF with Unusual Hostname
2020-04-30/a>
Xavier Mertens
Collecting IOCs from IMAP Folder
2020-04-29/a>
Johannes Ullrich
Privacy Preserving Protocols to Trace Covid19 Exposure
2020-04-28/a>
Jan Kopriva
Agent Tesla delivered by the same phishing campaign for over a year
2020-04-27/a>
Xavier Mertens
Powershell Payload Stored in a PSCredential Object
2020-04-18/a>
Guy Bruneau
Maldoc Falsely Represented as DOCX Invoice Redirecting to Fake Apple Store
2020-04-17/a>
Xavier Mertens
Weaponized RTF Document Generator & Mailer in PowerShell
2020-04-16/a>
Johannes Ullrich
Using AppLocker to Prevent Living off the Land Attacks
2020-04-13/a>
Jan Kopriva
Look at the same phishing campaign 3 months apart
2020-04-07/a>
Johannes Ullrich
Increase in RDP Scanning
2020-04-03/a>
Xavier Mertens
Obfuscated with a Simple 0x0A
2020-03-27/a>
Xavier Mertens
Malicious JavaScript Dropping Payload in the Registry
2020-03-24/a>
Russ McRee
Another Critical COVID-19 Shortage: Digital Security
2020-03-21/a>
Guy Bruneau
Honeypot - Scanning and Targeting Devices & Services
2020-03-15/a>
Guy Bruneau
VPN Access and Activity Monitoring
2020-03-14/a>
Didier Stevens
Phishing PDF With Incremental Updates.
2020-03-11/a>
Xavier Mertens
Agent Tesla Delivered via Fake Canon EOS Notification on Free OwnCloud Account
2020-03-05/a>
Xavier Mertens
Will You Put Your Password in a Survey?
2020-02-29/a>
Guy Bruneau
Hazelcast IMDG Discover Scan
2020-02-28/a>
Xavier Mertens
Show me Your Clipboard Data!
2020-02-16/a>
Guy Bruneau
SOAR or not to SOAR?
2020-02-14/a>
Xavier Mertens
Keep an Eye on Command-Line Browsers
2020-02-12/a>
Rob VandenBrink
March Patch Tuesday is Coming - the LDAP Changes will Change Your Life!
2020-02-10/a>
Jan Kopriva
Current PayPal phishing campaign or "give me all your personal information"
2020-02-05/a>
Brad Duncan
Fake browser update pages are "still a thing"
2020-02-03/a>
Jan Kopriva
Analysis of a triple-encrypted AZORult downloader
2020-02-02/a>
Didier Stevens
Video: Stego & Cryptominers
2020-01-25/a>
Guy Bruneau
Is Threat Hunting the new Fad?
2020-01-24/a>
Xavier Mertens
Why Phishing Remains So Popular?
2020-01-21/a>
Russ McRee
DeepBlueCLI: Powershell Threat Hunting
2020-01-16/a>
Jan Kopriva
Picks of 2019 malware - the large, the small and the one full of null bytes
2020-01-12/a>
Guy Bruneau
ELK Dashboard and Logstash parser for tcp-honeypot Logs
2020-01-06/a>
Johannes Ullrich
Increase in Number of Sources January 3rd and 4th: spoofed
2020-01-05/a>
Didier Stevens
etl2pcapng: Convert .etl Capture Files To .pcapng Format
2020-01-04/a>
Didier Stevens
KringleCon 2019
2019-12-26/a>
Xavier Mertens
Bypassing UAC to Install a Cryptominer
2019-12-22/a>
Didier Stevens
Extracting VBA Macros From .DWG Files
2019-12-16/a>
Didier Stevens
Malicious .DWG Files?
2019-12-13/a>
Jan Kopriva
Internet banking sites and their use of TLS... and SSLv3... and SSLv2?!
2019-12-07/a>
Guy Bruneau
Integrating Pi-hole Logs in ELK with Logstash
2019-12-06/a>
Jan Kopriva
Phishing with a self-contained credentials-stealing webpage
2019-12-05/a>
Jan Kopriva
E-mail from Agent Tesla
2019-12-04/a>
Jan Kopriva
Analysis of a strangely poetic malware
2019-11-27/a>
Brad Duncan
Finding an Agent Tesla malware sample
2019-11-26/a>
Jan Kopriva
Lessons learned from playing a willing phish
2019-11-23/a>
Guy Bruneau
Local Malware Analysis with Malice
2019-11-22/a>
Xavier Mertens
Abusing Web Filters Misconfiguration for Reconnaissance
2019-11-03/a>
Didier Stevens
You Too? "Unusual Activity with Double Base64 Encoding"
2019-11-01/a>
Didier Stevens
Tip: Password Managers and 2FA
2019-10-31/a>
Jan Kopriva
EML attachments in O365 - a recipe for phishing
2019-10-30/a>
Xavier Mertens
Keep an Eye on Remote Access to Mailboxes
2019-10-29/a>
Xavier Mertens
Generating PCAP Files from YAML
2019-10-27/a>
Guy Bruneau
Unusual Activity with Double Base64 Encoding
2019-10-27/a>
Didier Stevens
Using scdbg to Find Shellcode
2019-10-24/a>
Johannes Ullrich
Your Supply Chain Doesn't End At Receiving: How Do You Decommission Network Equipment?
2019-10-20/a>
Guy Bruneau
Scanning Activity for NVMS-9000 Digital Video Recorder
2019-10-17/a>
Jan Kopriva
Phishing e-mail spoofing SPF-enabled domain
2019-10-16/a>
Xavier Mertens
Security Monitoring: At Network or Host Level?
2019-10-10/a>
Rob VandenBrink
Mining Live Networks for OUI Data Oddness
2019-09-27/a>
Xavier Mertens
New Scans for Polycom Autoconfiguration Files
2019-09-19/a>
Xavier Mertens
Agent Tesla Trojan Abusing Corporate Email Accounts
2019-09-19/a>
Xavier Mertens
Blocklisting or Whitelisting in the Right Way
2019-09-17/a>
Rob VandenBrink
Investigating Gaps in your Windows Event Logs
2019-09-07/a>
Guy Bruneau
Unidentified Scanning Activity
2019-09-03/a>
Johannes Ullrich
[Guest Diary] Tricky LNK points to TrickBot
2019-08-15/a>
Didier Stevens
Analysis of a Spearphishing Maldoc
2019-08-14/a>
Brad Duncan
Recent example of MedusaHTTP malware
2019-08-09/a>
Xavier Mertens
100% JavaScript Phishing Page
2019-08-08/a>
Johannes Ullrich
[Guest Diary] The good, the bad and the non-functional, or "how not to do an attack campaign"
2019-07-25/a>
Rob VandenBrink
When Users Attack! Users (and Admins) Thwarting Security Controls
2019-07-17/a>
Xavier Mertens
Analyzis of DNS TXT Records
2019-07-13/a>
Guy Bruneau
Guidance to Protect DNS Against Hijacking & Scanning for Version.BIND Still a Thing
2019-07-09/a>
John Bambenek
Solving the WHOIS and Privacy Problem: A Draft of Implementing WHOIS in DNS
2019-06-27/a>
Rob VandenBrink
Finding the Gold in a Pile of Pennies - Long Tail Analysis in PowerShell
2019-06-25/a>
Brad Duncan
Rig Exploit Kit sends Pitou.B Trojan
2019-06-24/a>
Johannes Ullrich
Extensive BGP Issues Affecting Cloudflare and possibly others
2019-06-20/a>
Xavier Mertens
Using a Travel Packing App for Infosec Purpose
2019-06-19/a>
Johannes Ullrich
Critical Actively Exploited WebLogic Flaw Patched CVE-2019-2729
2019-06-17/a>
Brad Duncan
An infection from Rig exploit kit
2019-06-14/a>
Jim Clausing
A few Ghidra tips for IDA users, part 4 - function call graphs
2019-06-06/a>
Xavier Mertens
Keep an Eye on Your WMI Logs
2019-05-30/a>
Didier Stevens
Analyzing First Stage Shellcode
2019-05-19/a>
Guy Bruneau
Is Metadata Only Approach, Good Enough for Network Traffic Analysis?
2019-05-13/a>
Xavier Mertens
From Phishing To Ransomware?
2019-05-06/a>
Didier Stevens
Text and T
e
x
t
2019-05-03/a>
Jim Clausing
A few Ghidra tips for IDA users, part 3 - conversion, labels, and comments
2019-05-01/a>
Xavier Mertens
Another Day, Another Suspicious UDF File
2019-04-28/a>
Johannes Ullrich
Update about Weblogic CVE-2019-2725 (Exploits Used in the Wild, Patch Status)
2019-04-25/a>
Rob VandenBrink
Unpatched Vulnerability Alert - WebLogic Zero Day
2019-04-17/a>
Jim Clausing
A few Ghidra tips for IDA users, part 2 - strings and parameters
2019-04-17/a>
Xavier Mertens
Malware Sample Delivered Through UDF Image
2019-04-08/a>
Jim Clausing
A few Ghidra tips for IDA users, part 1 - the decompiler/unreachable code
2019-04-05/a>
Russ McRee
Beagle: Graph transforms for DFIR data & logs
2019-04-03/a>
Jim Clausing
A few Ghidra tips for IDA users, part 0 - automatic comments for API call parameters
2019-03-27/a>
Xavier Mertens
Running your Own Passive DNS Service
2019-03-14/a>
Didier Stevens
Tip: Ghidra & ZIP Files
2019-03-08/a>
Remco Verhoef
Analysing meterpreter payload with Ghidra
2019-02-28/a>
Tom Webb
Phishing impersonations
2019-02-21/a>
Xavier Mertens
Simple Powershell Keyloggers are Back
2019-02-18/a>
Didier Stevens
Know What You Are Logging
2019-02-14/a>
Xavier Mertens
Old H-Worm Delivered Through GitHub
2019-02-07/a>
Xavier Mertens
Phishing Kit with JavaScript Keylogger
2019-02-06/a>
Brad Duncan
Hancitor malspam and infection traffic from Tuesday 2019-02-05
2019-02-05/a>
Rob VandenBrink
Mitigations against Mimikatz Style Attacks
2019-02-03/a>
Didier Stevens
Video: Analyzing a Simple HTML Phishing Attachment
2019-01-31/a>
Xavier Mertens
Tracking Unexpected DNS Changes
2019-01-29/a>
Johannes Ullrich
A Not So Well Done Phish (Why Attackers need to Implement IPv6 Now! ;-) )
2019-01-28/a>
Bojan Zdrnja
Relaying Exchange?s NTLM authentication to domain admin (and more)
2019-01-21/a>
Didier Stevens
Suspicious GET Request: Do You Know What This Is?
2019-01-16/a>
Brad Duncan
Emotet infections and follow-up malware
2019-01-14/a>
Rob VandenBrink
Microsoft LAPS - Blue Team / Red Team
2019-01-10/a>
Brad Duncan
Heartbreaking Emails: "Love You" Malspam
2019-01-09/a>
Russ McRee
gganimate: Animate YouR Security Analysis
2019-01-05/a>
Didier Stevens
A Malicious JPEG? Second Example
2019-01-04/a>
Didier Stevens
A Malicious JPEG?
2019-01-02/a>
Lorna Hutcheson
Gift Card Scams on the rise
2018-12-27/a>
Didier Stevens
Matryoshka Phish
2018-12-23/a>
Guy Bruneau
Scanning Activity, end Goal is to add Hosts to Mirai Botnet
2018-12-22/a>
Didier Stevens
KringleCon 2018
2018-12-21/a>
Lorna Hutcheson
Phishing Attempts That Bypass 2FA
2018-12-19/a>
Xavier Mertens
Using OSSEC Active-Response as a DFIR Framework
2018-12-16/a>
Guy Bruneau
Random Port Scan for Open RDP Backdoor
2018-12-13/a>
Xavier Mertens
Phishing Attack Through Non-Delivery Notification
2018-12-09/a>
Didier Stevens
Quickie: String Analysis is Still Useful
2018-11-20/a>
Xavier Mertens
Querying DShield from Cortex
2018-11-19/a>
Xavier Mertens
The Challenge of Managing Your Digital Library
2018-11-18/a>
Guy Bruneau
Multipurpose PCAP Analysis Tool
2018-11-17/a>
Xavier Mertens
Quickly Investigating Websites with Lookyloo
2018-11-15/a>
Brad Duncan
Emotet infection with IcedID banking Trojan
2018-11-11/a>
Pasquale Stirparo
Community contribution: joining forces or multiply solutions?
2018-10-21/a>
Didier Stevens
MSG Files: Compressed RTF
2018-10-17/a>
Russ McRee
RedHunt Linux - Adversary Emulation, Threat Hunting & Intelligence
2018-09-24/a>
Didier Stevens
Analyzing Encoded Shellcode with scdbg
2018-09-20/a>
Xavier Mertens
Hunting for Suspicious Processes with OSSEC
2018-09-08/a>
Didier Stevens
Video: Using scdbg to analyze shellcode
2018-09-03/a>
Didier Stevens
Another quickie: Using scdbg to analyze shellcode
2018-08-26/a>
Didier Stevens
Identifying numeric obfuscation
2018-08-23/a>
Xavier Mertens
Simple Phishing Through formcrafts.com
2018-08-19/a>
Didier Stevens
Video: Peeking into msg files - revisited
2018-08-12/a>
Didier Stevens
A URL shortener handy for phishers
2018-08-11/a>
Didier Stevens
Peeking into msg files - revisited
2018-08-10/a>
Remco Verhoef
Hunting SSL/TLS clients using JA3
2018-08-06/a>
Didier Stevens
Numeric obfuscation: another example
2018-08-04/a>
Didier Stevens
Dealing with numeric obfuscation in malicious scripts
2018-08-02/a>
Brad Duncan
DHL-themed malspam reveals embedded malware in animated gif
2018-07-30/a>
Xavier Mertens
Exploiting the Power of Curl
2018-07-29/a>
Guy Bruneau
Using RITA for Threat Analysis
2018-07-23/a>
Didier Stevens
Analyzing MSG files
2018-07-20/a>
Kevin Liston
Weblogic Exploit Code Made Public (CVE-2018-2893)
2018-07-17/a>
Xavier Mertens
Searching for Geographically Improbable Login Attempts
2018-07-03/a>
Didier Stevens
Progress indication for scripts on Windows
2018-07-02/a>
Guy Bruneau
Hello Peppa! - PHP Scans
2018-07-01/a>
Didier Stevens
Video: Analyzing XPS Files
2018-06-30/a>
Didier Stevens
XPS samples
2018-06-26/a>
Didier Stevens
Analyzing XPS files
2018-06-22/a>
Lorna Hutcheson
XPS Attachment Used for Phishing
2018-06-21/a>
Xavier Mertens
Are Your Hunting Rules Still Working?
2018-06-19/a>
Xavier Mertens
PowerShell: ScriptBlock Logging... Or Not?
2018-06-13/a>
Xavier Mertens
A Bunch of Compromized Wordpress Sites
2018-06-07/a>
Remco Verhoef
Automated twitter loot collection
2018-06-06/a>
Xavier Mertens
Converting PCAP Web Traffic to Apache Log
2018-06-04/a>
Rob VandenBrink
Digging into Authenticode Certificates
2018-05-27/a>
Guy Bruneau
Capture and Analysis of User Agents
2018-05-24/a>
Xavier Mertens
"Blocked" Does Not Mean "Forget It"
2018-05-20/a>
Didier Stevens
DASAN GPON home routers exploits in-the-wild
2018-05-16/a>
Mark Hofman
EFAIL, a weakness in openPGP and S\MIME
2018-05-09/a>
Xavier Mertens
Nice Phishing Sample Delivering Trickbot
2018-05-03/a>
Renato Marinho
WebLogic Exploited in the Wild (Again)
2018-04-25/a>
Johannes Ullrich
Yet Another Drupal RCE Vulnerability
2018-03-12/a>
Xavier Mertens
Payload delivery via SMB
2018-03-06/a>
Mark Hofman
The joys of changing Privacy Laws
2018-03-02/a>
Xavier Mertens
Common Patterns Used in Phishing Campaigns Files
2018-02-25/a>
Guy Bruneau
Blackhole Advertising Sites with Pi-hole
2018-02-25/a>
Didier Stevens
Retrieving malware over Tor on Windows
2018-02-01/a>
Xavier Mertens
Adaptive Phishing Kit
2018-01-31/a>
Tom Webb
Tax Phishing Time
2018-01-23/a>
John Bambenek
Life after GDPR: Implications for Cybersecurity
2018-01-20/a>
Didier Stevens
An RTF phish
2018-01-18/a>
Xavier Mertens
Comment your Packet Captures!
2018-01-12/a>
Bojan Zdrnja
Those pesky registry keys required by critical security patches
2018-01-11/a>
Xavier Mertens
Mining or Nothing!
2018-01-10/a>
Russ McRee
GitHub InfoSec Threepeat: HELK, ptf, and VulnWhisperer
2018-01-07/a>
Guy Bruneau
SSH Scans by Clients Types
2018-01-03/a>
John Bambenek
Phishing to Rural America Leads to Six-figure Wire Fraud Losses
2018-01-02/a>
Didier Stevens
PDF documents & URLs: video
2018-01-01/a>
Didier Stevens
What is new?
2017-12-27/a>
Guy Bruneau
What are your Security Challenges for 2018?
2017-12-13/a>
Xavier Mertens
Tracking Newly Registered Domains
2017-12-02/a>
Xavier Mertens
Using Bad Material for the Good
2017-12-01/a>
Xavier Mertens
Phishing Kit (Ab)Using Cloud Services
2017-11-28/a>
Xavier Mertens
Apple High Sierra Uses a Passwordless Root Account
2017-11-25/a>
Guy Bruneau
Benefits associated with the use of Open Source Software
2017-11-23/a>
Xavier Mertens
Proactive Malicious Domain Search
2017-11-17/a>
Xavier Mertens
Top-100 Malicious IP STIX Feed
2017-11-15/a>
Xavier Mertens
If you want something done right, do it yourself!
2017-11-13/a>
Guy Bruneau
jsonrpc Scanning for root account
2017-11-10/a>
Bojan Zdrnja
Battling e-mail phishing
2017-11-05/a>
Didier Stevens
Extracting the text from PDF documents
2017-11-04/a>
Didier Stevens
PDF documents & URLs
2017-11-01/a>
Rob VandenBrink
Securing SSH Services - Go Blue Team!!
2017-10-30/a>
Johannes Ullrich
Critical Patch For Oracle's Identity Manager
2017-10-24/a>
Xavier Mertens
Stop relying on file extensions
2017-10-18/a>
Renato Marinho
Baselining Servers to Detect Outliers
2017-10-15/a>
Didier Stevens
Peeking into .msg files
2017-10-12/a>
Xavier Mertens
Version control tools aren't only for Developers
2017-10-08/a>
Didier Stevens
A strange JPEG file
2017-10-06/a>
Johannes Ullrich
What's in a cable? The dangers of unauthorized cables
2017-10-02/a>
Xavier Mertens
Investigating Security Incidents with Passive DNS
2017-09-29/a>
Lorna Hutcheson
Good Analysis = Understanding(tools + logs + normal)
2017-09-25/a>
Renato Marinho
XPCTRA Malware Steals Banking and Digital Wallet User's Credentials
2017-09-22/a>
Russell Eubanks
What is the State of Your Union?
2017-09-18/a>
Xavier Mertens
Getting some intelligence from malspam
2017-09-18/a>
Johannes Ullrich
SANS Securingthehuman posted a follow up to their Equifax breach webcast: https://securingthehuman.sans.org/blog/2017/09/15/equifax-webcast-follow-up
2017-09-11/a>
Russ McRee
Windows Auditing with WINspect
2017-09-10/a>
Didier Stevens
Analyzing JPEG files
2017-09-06/a>
Adrien de Beaupre
Modern Web Application Penetration Testing , Hash Length Extension Attacks
2017-09-02/a>
Xavier Mertens
AutoIT based malware back in the wild
2017-08-22/a>
Xavier Mertens
Defang all the things!
2017-08-18/a>
Renato Marinho
EngineBox Malware Supports 10+ Brazilian Banks
2017-08-16/a>
Xavier Mertens
Analysis of a Paypal phishing kit
2017-08-15/a>
Brad Duncan
Malspam pushing Trickbot banking Trojan
2017-08-15/a>
Renato Marinho
(Banker(GoogleChromeExtension)).targeting("Brazil")
2017-08-13/a>
Didier Stevens
The Good Phishing Email
2017-07-30/a>
Guy Bruneau
Text Banking Scams
2017-07-16/a>
Renato Marinho
SMS Phishing induces victims to photograph its own token card
2017-07-12/a>
Xavier Mertens
Backup Scripts, the FIM of the Poor
2017-07-09/a>
Russ McRee
Adversary hunting with SOF-ELK
2017-07-05/a>
Didier Stevens
Selecting domains with random names
2017-06-28/a>
Brad Duncan
Catching up with Blank Slate: a malspam campaign still going strong
2017-06-27/a>
Brad Duncan
A Tale of Two Phishies
2017-06-17/a>
Guy Bruneau
Mapping Use Cases to Logs. Which Logs are the Most Important to Collect?
2017-06-15/a>
Bojan Zdrnja
Uberscammers
2017-06-14/a>
Xavier Mertens
Systemd Could Fallback to Google DNS?
2017-06-08/a>
Tom Webb
Summer STEM for Kids
2017-06-02/a>
Xavier Mertens
Phishing Campaigns Follow Trends
2017-06-01/a>
Xavier Mertens
Sharing Private Data with Webcast Invitations
2017-05-31/a>
Pasquale Stirparo
Analysis of Competing Hypotheses, WCry and Lazarus (ACH part 2)
2017-05-28/a>
Pasquale Stirparo
Analysis of Competing Hypotheses (ACH part 1)
2017-05-28/a>
Guy Bruneau
CyberChef a Must Have Tool in your Tool bag!
2017-05-20/a>
Xavier Mertens
Typosquatting: Awareness and Hunting
2017-05-17/a>
Richard Porter
Wait What? We don?t have to change passwords every 90 days?
2017-05-13/a>
Guy Bruneau
Has anyone Tested WannaCry Killswitch? - https://blog.didierstevens.com/2017/05/13/quickpost-wcry-killswitch-check-is-not-proxy-aware/
2017-05-06/a>
Xavier Mertens
The story of the CFO and CEO...
2017-05-03/a>
Bojan Zdrnja
OAUTH phishing against Google Docs ? beware!
2017-04-27/a>
Johannes Ullrich
BGP Hijacking: The Internet is Still/Again Broken
2017-04-22/a>
Jim Clausing
WTF tcp port 81
2017-04-20/a>
Xavier Mertens
DNS Query Length... Because Size Does Matter
2017-04-18/a>
Johannes Ullrich
Yet Another Apple Phish and Some DNS Lessons Learned From It
2017-04-16/a>
Johannes Ullrich
Tool to Detect Active Phishing Attacks Using Unicode Look-Alike Domains
2017-04-13/a>
Rob VandenBrink
Packet Captures Filtered by Process
2017-04-02/a>
Guy Bruneau
IPFire - A Household Multipurpose Security Gateway
2017-03-28/a>
Xavier Mertens
Logical & Physical Security Correlation
2017-03-24/a>
Xavier Mertens
Nicely Obfuscated JavaScript Sample
2017-03-19/a>
Xavier Mertens
Searching for Base64-encoded PE Files
2017-03-15/a>
Xavier Mertens
Retro Hunting!
2017-03-10/a>
Xavier Mertens
The Side Effect of GeoIP Filters
2017-03-06/a>
Renato Marinho
A very convincing Typosquatting + Social Engineering campaign is targeting Santander corporate customers in Brazil
2017-02-28/a>
Xavier Mertens
Amazon S3 Outage
2017-02-25/a>
Guy Bruneau
Unpatched Microsoft Edge and IE Bug
2017-02-09/a>
Brad Duncan
CryptoShield Ransomware from Rig EK
2017-02-01/a>
Xavier Mertens
Quick Analysis of Data Left Available by Attackers
2017-01-24/a>
Xavier Mertens
Malicious SVG Files in the Wild
2017-01-11/a>
Johannes Ullrich
January 2017 Edition of Ouch! Security Awareness Newsletter Released: https://securingthehuman.sans.org/ouch
2017-01-10/a>
Johannes Ullrich
Realtors Be Aware: You Are a Target
2017-01-10/a>
Johannes Ullrich
Port 37777 "MapTable" Requests
2017-01-06/a>
John Bambenek
Great Misadventures of Security Vendors: Absurd Sandboxing Edition
2017-01-05/a>
John Bambenek
New Year's Resolution: Build Your Own Malware Lab?
2017-01-04/a>
John Bambenek
Mixed Messages : Novel Phishing Attempts Trying to Steal Your E-mail Password Goes Wrong
2016-12-29/a>
Rick Wanner
More on Protocol 47 denys
2016-12-29/a>
Rick Wanner
Increase in Protocol 47 denys
2016-12-27/a>
Guy Bruneau
Using daemonlogger as a Software Tap
2016-12-11/a>
Russ McRee
Steganography in Action: Image Steganography & StegExpose
2016-12-09/a>
Rick Wanner
Mirai - now with DGA
2016-12-06/a>
Bojan Zdrnja
Attacking NoSQL applications
2016-11-16/a>
Xavier Mertens
Example of Getting Analysts & Researchers Away
2016-11-02/a>
Rob VandenBrink
What Does a Pentest Look Like?
2016-10-25/a>
Xavier Mertens
Another Day, Another Spam...
2016-10-10/a>
Didier Stevens
Radare2: rahash2
2016-10-08/a>
Russell Eubanks
Unauthorized Change Detected!
2016-10-02/a>
Guy Bruneau
Is there an Infosec Cybersecurity Talent Shortage?
2016-09-25/a>
Pasquale Stirparo
Defining Threat Intelligence Requirements
2016-09-04/a>
Russ McRee
Kali Linux 2016.2 Release: https://www.kali.org/news/kali-linux-20162-release/
2016-09-01/a>
Xavier Mertens
Maxmind.com (Ab)used As Anti-Analysis Technique
2016-08-31/a>
Deborah Hale
Angler Exploit Kits Reported
2016-08-29/a>
Russ McRee
Recommended Reading: Intrusion Detection Using Indicators of Compromise Based on Best Practices and Windows Event Logs
2016-08-23/a>
Xavier Mertens
Voice Message Notifications Deliver Ransomware
2016-08-21/a>
Rick Wanner
Cisco ASA SNMP Remote Code Execution Vulnerability
2016-08-01/a>
Daniel Wesemann
Are you getting I-CANNED ?
2016-07-31/a>
Pasquale Stirparo
Sharing (intel) is caring... or not?
2016-07-27/a>
Xavier Mertens
Critical Xen PV guests vulnerabilities
2016-07-21/a>
Didier Stevens
Practice ntds.dit File
2016-07-15/a>
Xavier Mertens
Name All the Things!
2016-07-12/a>
Xavier Mertens
Hunting for Malicious Files with MISP + OSSEC
2016-07-03/a>
Guy Bruneau
Is Data Privacy part of your Company's Culture?
2016-06-29/a>
Xavier Mertens
Phishing Campaign with Blurred Images
2016-06-23/a>
Russell Eubanks
An Approach to Vulnerability Management
2016-06-20/a>
Xavier Mertens
Using Your Password Manager to Monitor Data Leaks
2016-06-18/a>
Rob VandenBrink
Controlling JavaScript Malware Before it Runs
2016-06-15/a>
Richard Porter
Warp Speed Ahead, L7 Open Source Packet Generator: Warp17
2016-06-03/a>
Tom Liston
MySQL is YourSQL
2016-06-01/a>
Xavier Mertens
Docker Containers Logging
2016-05-22/a>
Pasquale Stirparo
The strange case of WinZip MRU Registry key
2016-05-18/a>
Russ McRee
Resources: Windows Auditing & Monitoring, Linux 2FA
2016-05-12/a>
Xavier Mertens
Another Day, Another Wave of Phishing Emails
2016-05-02/a>
Rick Wanner
Lean Threat Intelligence
2016-04-21/a>
Daniel Wesemann
Decoding Pseudo-Darkleech (#1)
2016-04-21/a>
Daniel Wesemann
Decoding Pseudo-Darkleech (Part #2)
2016-04-02/a>
Russell Eubanks
Why Can't We Be Friends?
2016-03-30/a>
Xavier Mertens
What to watch with your FIM?
2016-03-21/a>
Xavier Mertens
IP Addresses Triage
2016-03-07/a>
Xavier Mertens
OSX Ransomware Spread via a Rogue BitTorrent Client Installer
2016-02-28/a>
Guy Bruneau
RFC 6598 - Carrier Grade NAT
2016-02-27/a>
Guy Bruneau
Wireshark Fixes Several Bugs and Vulnerabilities
2016-02-07/a>
Xavier Mertens
More Malicious JavaScript Obfuscation
2016-02-02/a>
Johannes Ullrich
Targeted IPv6 Scans Using pool.ntp.org .
2016-01-29/a>
Xavier Mertens
Scripting Web Categorization
2016-01-23/a>
Didier Stevens
Sigcheck and VirusTotal for Offline Machine
2016-01-21/a>
Jim Clausing
Scanning for Fortinet ssh backdoor
2016-01-20/a>
Xavier Mertens
/tmp, %TEMP%, ~/Desktop, T:\, ... A goldmine for pentesters!
2016-01-13/a>
Alex Stanford
You Have Got a New Audio Message - Guest Diary by Pasquale Stirparo
2016-01-11/a>
Didier Stevens
BlackEnergy .XLS Dropper
2016-01-05/a>
Guy Bruneau
What are you Concerned the Most in 2016?
2015-12-24/a>
Xavier Mertens
Unity Makes Strength
2015-12-13/a>
Didier Stevens
Use The Privilege
2015-12-12/a>
Russell Eubanks
What Signs Are You Missing?
2015-12-10/a>
Rob VandenBrink
New Burp Feature - ClickBandit
2015-12-04/a>
Tom Webb
Automating Phishing Analysis using BRO
2015-11-21/a>
Didier Stevens
Maldoc Social Engineering Trick
2015-11-09/a>
John Bambenek
ICYMI: Widespread Unserialize Vulnerability in Java
2015-10-20/a>
Bojan Zdrnja
When encoding saves the day
2015-10-12/a>
Guy Bruneau
Data Visualization,What is your Tool of Choice?
2015-10-11/a>
Tony Carothers
GnuPG (GPG) 2.1.9 release announced
2015-09-23/a>
Daniel Wesemann
Making our users unlearn what we taught them
2015-09-21/a>
Xavier Mertens
Detecting XCodeGhost Activity
2015-09-08/a>
Lenny Zeltser
A Close Look at PayPal Overpayment Scams That Target Craigslist Sellers
2015-09-03/a>
Xavier Mertens
Querying the DShield API from RTIR
2015-09-01/a>
Daniel Wesemann
How to hack
2015-08-19/a>
Bojan Zdrnja
Outsourcing critical infrastructure (such as DNS)
2015-08-16/a>
Guy Bruneau
Are you a "Hunter"?
2015-08-06/a>
Didier Stevens
Sigcheck and virustotal-search
2015-07-31/a>
Russ McRee
Tech tip: Invoke a system command in R
2015-07-31/a>
Russ McRee
Tech tip follow-up: Using the data Invoked with R's system command
2015-07-28/a>
Rick Wanner
Android Stagefright multimedia viewer prone to remote exploitation
2015-07-27/a>
Daniel Wesemann
Angler's best friends
2015-07-23/a>
Mark Hofman
Some more 0-days from ZDI
2015-07-18/a>
Russell Eubanks
The Value a "Fresh Set Of Eyes" (FSOE)
2015-07-17/a>
Didier Stevens
Sigcheck and VirusTotal
2015-06-22/a>
Johannes Ullrich
SMTP Brute Forcing
2015-06-01/a>
Tom Webb
Submit Dshield ASA Logs
2015-05-30/a>
Russell Eubanks
Weekend Learning - Spoofer Project
2015-05-23/a>
Guy Bruneau
Business Value in "Big Data"
2015-05-20/a>
Brad Duncan
Logjam - vulnerabilities in Diffie-Hellman key exchange affect browsers and servers using TLS
2015-05-10/a>
Didier Stevens
Wireshark TCP Flags: How To Install On Windows Video
2015-04-27/a>
Richard Porter
When Prevention Fails, Incident Response Begins
2015-04-23/a>
Bojan Zdrnja
When automation does not help
2015-04-17/a>
Didier Stevens
Memory Forensics Of Network Devices
2015-04-05/a>
Didier Stevens
Wireshark TCP Flags
2015-04-03/a>
Didier Stevens
SSH Fingerprints Are Important
2015-04-02/a>
Brad Duncan
Angler Exploit Kit - Recent Traffic Patterns
2015-04-01/a>
Brad Duncan
Rig Exploit Kit Changes Traffic Patterns
2015-03-26/a>
Daniel Wesemann
Pin-up on your Smartphone!
2015-03-11/a>
Rob VandenBrink
Syslog Skeet Shooting - Targetting Real Problems in Event Logs
2015-03-11/a>
Rob VandenBrink
Apple iTunes Store is seeing an extended outage (11 Mar) - watch https://www.apple.com/support/systemstatus/ for status changes. (12 Mar) - service restored, all green!
2015-03-01/a>
Rick Wanner
Advisory: Seagate NAS Remote Code Execution
2015-02-19/a>
Daniel Wesemann
DNS-based DDoS
2015-02-12/a>
Johannes Ullrich
Did You Remove That Debug Code? Netatmo Weather Station Sending WPA Passphrase in the Clear
2015-02-11/a>
Johannes Ullrich
Microsoft Hardens GPO by Fixing Two Serious Vulnerabilities.
2015-02-03/a>
Johannes Ullrich
What is using this library?
2015-02-01/a>
Rick Wanner
Improving SSL Warnings
2015-01-31/a>
Guy Bruneau
Beware of Phishing and Spam Super Bowl Fans!
2015-01-27/a>
Johannes Ullrich
New Critical GLibc Vulnerability CVE-2015-0235 (aka GHOST)
2014-12-23/a>
John Bambenek
How I learned to stop worrying and love malware DGAs....
2014-12-06/a>
Rick Wanner
Google App Engine Java Security Sandbox bypasses
2014-11-27/a>
Russ McRee
Syrian Electronic Army attack leads to malvertising
2014-11-19/a>
Rob VandenBrink
"Big Data" Needs a Trip to the Security Chiropracter!
2014-11-04/a>
Daniel Wesemann
Whois someone else?
2014-09-27/a>
Guy Bruneau
What has Bash and Heartbleed Taught Us?
2014-09-26/a>
Richard Porter
Why We Have Moved to InfoCon:Yellow
2014-09-22/a>
Johannes Ullrich
Fake LogMeIn Certificate Update with Bad AV Detection Rate
2014-09-19/a>
Guy Bruneau
Web Scan looking for /info/whitelist.pac
2014-09-19/a>
Guy Bruneau
PHP Fixes Several Bugs in Version 5.4 and 5.5
2014-09-16/a>
Daniel Wesemann
https://yourfakebank.support -- TLD confusion starts!
2014-09-15/a>
Johannes Ullrich
Google DNS Server IP Address Spoofed for SNMP reflective Attacks
2014-09-12/a>
Chris Mohan
Are credential dumps worth reviewing?
2014-09-03/a>
Johannes Ullrich
F5 BigIP Unauthenticated rsync Vulnerability
2014-08-27/a>
Rob VandenBrink
One More Day of Trolling in POS Memory
2014-08-22/a>
Richard Porter
OCLHashCat 1.30 Released
2014-08-20/a>
Kevin Shortt
Social Engineering Alive and Well
2014-08-15/a>
Tom Webb
AppLocker Event Logs with OSSEC 2.8
2014-08-09/a>
Adrien de Beaupre
Complete application ownage via Multi-POST XSRF
2014-08-05/a>
Johannes Ullrich
Synolocker: Why OFFLINE Backups are important
2014-08-05/a>
Johannes Ullrich
Legal Threat Spam: Sometimes it Gets Personal
2014-08-04/a>
Russ McRee
Threats & Indicators: A Security Intelligence Lifecycle
2014-07-30/a>
Rick Wanner
Symantec Endpoint Protection Privilege Escalation Zero Day
2014-07-23/a>
Johannes Ullrich
New Feature: "Live" SSH Brute Force Logs and New Kippo Client
2014-07-18/a>
Russ McRee
Gameover Zeus reported as "returned from the dead"
2014-07-15/a>
Daniel Wesemann
Oracle July 2014 CPU (patch bundle)
2014-07-14/a>
Johannes Ullrich
The Internet of Things: How do you "on-board" devices?
2014-07-14/a>
Daniel Wesemann
E-ZPass phishing scam
2014-07-11/a>
Rob VandenBrink
Egress Filtering? What - do we have a bird problem?
2014-07-09/a>
Daniel Wesemann
Who owns your typo?
2014-07-09/a>
Daniel Wesemann
Who inherits your IP address?
2014-07-08/a>
Johannes Ullrich
Hardcoded Netgear Prosafe Switch Password
2014-07-02/a>
Johannes Ullrich
July Ouch! Security Awareness Newsletter Released. E-mail Do's and Don'ts http://www.securingthehuman.org/resources/newsletters/ouch/2014#july2014
2014-06-13/a>
Richard Porter
A welcomed response, PF Chang's
2014-06-04/a>
Richard Porter
p0f, Got Packets?
2014-06-02/a>
John Bambenek
Gameover Zeus and Cryptolocker Takedowns
2014-06-02/a>
Rick Wanner
Using nmap to scan for DDOS reflectors
2014-05-30/a>
Johannes Ullrich
Fake Australian Electric Bill Leads to Cryptolocker
2014-05-23/a>
Richard Porter
Highlights from Cisco Live 2014 - The Internet of Everything
2014-05-22/a>
Rob VandenBrink
Another Site Breached - Time to Change your Passwords! (If you can that is)
2014-05-18/a>
Russ McRee
sed and awk will always rock
2014-05-07/a>
Johannes Ullrich
De-Clouding your Life: Things that should not go into the cloud.
2014-05-01/a>
Johannes Ullrich
Busybox Honeypot Fingerprinting and a new DVR scanner
2014-04-27/a>
Tony Carothers
The Dreaded "D" Word of IT
2014-04-26/a>
Guy Bruneau
Android Users - Beware of Bitcoin Mining Malware
2014-04-21/a>
Daniel Wesemann
Finding the bleeders
2014-04-12/a>
Guy Bruneau
Interested in a Heartbleed Challenge?
2014-04-08/a>
Guy Bruneau
OpenSSL CVE-2014-0160 Fixed
2014-04-05/a>
Jim Clausing
Those strange e-mails with URLs in them can lead to Android malware
2014-04-04/a>
Rob VandenBrink
Dealing with Disaster - A Short Malware Incident Response
2014-04-01/a>
Johannes Ullrich
cmd.so Synology Scanner Also Found on Routers
2014-03-31/a>
Johannes Ullrich
More Device Malware: This is why your DVR attacked my Synology Disk Station (and now with Bitcoin Miner!)
2014-03-28/a>
Johannes Ullrich
War of the Bots: When DVRs attack NASs
2014-03-27/a>
Alex Stanford
Apple Credential Phishing via appleidconfirm.net
2014-03-26/a>
Johannes Ullrich
Let's Finally "Nail" This Port 5000 Traffic - Synology owners needed.
2014-03-17/a>
Johannes Ullrich
Scans for FCKEditor File Manager
2014-03-13/a>
Daniel Wesemann
Web server logs containing RS=^ ?
2014-03-12/a>
Johannes Ullrich
Wordpress "Pingback" DDoS Attacks
2014-03-04/a>
Daniel Wesemann
Triple Handshake Cookie Cutter
2014-03-02/a>
Stephen Hall
Sunday Reading
2014-02-28/a>
Daniel Wesemann
Oversharing
2014-02-19/a>
Russ McRee
Threat modeling in the name of security
2014-02-18/a>
Johannes Ullrich
More Details About "TheMoon" Linksys Worm
2014-02-15/a>
Rob VandenBrink
More on HNAP - What is it, How to Use it, How to Find it
2014-02-14/a>
Chris Mohan
Scanning activity for /siemens/bootstrapping/JnlpBrowser/Development/
2014-02-13/a>
Johannes Ullrich
Linksys Worm ("TheMoon") Captured
2014-02-12/a>
Johannes Ullrich
Suspected Mass Exploit Against Linksys E1000 / E1200 Routers
2014-02-10/a>
Rob VandenBrink
A Tale of Two Admins (and no Change Control)
2014-02-09/a>
Basil Alawi S.Taher
Mandiant Highlighter 2
2014-02-04/a>
Johannes Ullrich
Odd ICMP Echo Request Payload
2014-01-30/a>
Johannes Ullrich
New gTLDs appearing in the root zone
2014-01-27/a>
Basil Alawi S.Taher
Log Parsing with Mandiant Highlighter (1)
2014-01-24/a>
Johannes Ullrich
How to send mass e-mail the right way
2014-01-24/a>
Chris Mohan
Phishing via Social Media
2014-01-23/a>
Chris Mohan
Learning from the breaches that happens to others Part 2
2014-01-17/a>
Russ McRee
Massive RFI scans likely a free web app vuln scanner rather than bots
2014-01-14/a>
Chris Mohan
Spamming and scanning botnets - is there something I can do to block them from my site?
2014-01-11/a>
Guy Bruneau
tcpflow 1.4.4 and some of its most Interesting Features
2014-01-04/a>
Tom Webb
Monitoring Windows Networks Using Syslog (Part One)
2014-01-02/a>
John Bambenek
OpenSSL.org Defaced by Attackers Gaining Access to Hypervisor
2014-01-01/a>
Russ McRee
Six degrees of celebration: Juniper, ANT, Shodan, Maltego, Cisco, and Tails
2013-12-28/a>
Russ McRee
Weekend Reading List 27 DEC
2013-12-28/a>
Bojan Zdrnja
DRG online challenge(s)
2013-12-23/a>
Rob VandenBrink
How-To's for the Holidays - Java Whitelisting using AD Group Policy
2013-12-21/a>
Daniel Wesemann
Adobe phishing underway
2013-12-19/a>
Rob VandenBrink
Passive Scanning Two Ways - How-Tos for the Holidays
2013-12-19/a>
Rob VandenBrink
Target US - Credit Card Data Breach
2013-12-11/a>
Johannes Ullrich
Facebook Phishing and Malware via Tumblr Redirects
2013-12-09/a>
Rob VandenBrink
Scanning without Scanning
2013-12-07/a>
Guy Bruneau
Suspected Active Rovnix Botnet Controller
2013-12-03/a>
Rob VandenBrink
Even in the Quietest Moments ...
2013-11-29/a>
Russ McRee
MS Exchange update, includes failed backup fix: http://support.microsoft.com/kb/2892464
2013-11-27/a>
Rob VandenBrink
ATM Traffic + TCPDump + Video = Good or Evil?
2013-11-22/a>
Rick Wanner
Port 0 DDOS
2013-11-22/a>
Rick Wanner
Tales of Password Reuse
2013-11-16/a>
Guy Bruneau
Sagan as a Log Normalizer
2013-11-15/a>
Johannes Ullrich
The Security Impact of HTTP Caching Headers
2013-11-11/a>
Johannes Ullrich
What Happened to the SANS Ads?
2013-11-05/a>
Daniel Wesemann
TIFF images in MS-Office documents used in targeted attacks
2013-11-04/a>
Manuel Humberto Santander Pelaez
When attackers use your DNS to check for the sites you are visiting
2013-11-01/a>
Russ McRee
Secunia's PSI Country Report - Q3 2013
2013-10-30/a>
Russ McRee
SIR v15: Five good reasons to leave Windows XP behind
2013-10-25/a>
Johannes Ullrich
PHP.net compromise aftermath: Why Code Signing Beats Hashes
2013-10-25/a>
Rob VandenBrink
Kaspersky flags TCPIP.SYS as Malware
2013-10-24/a>
Johannes Ullrich
False Positive: php.net Malware Alert
2013-10-22/a>
Richard Porter
Greenbone and OpenVAS Scanner
2013-10-21/a>
Johannes Ullrich
New tricks that may bring DNS spoofing back or: "Why you should enable DNSSEC even if it is a pain to do"
2013-10-18/a>
Rob VandenBrink
CSAM - Why am I seeing DNS Requests to IANA.ORG in my Firewall Logs?
2013-10-17/a>
Adrien de Beaupre
Internet wide DNS scanning
2013-10-10/a>
Johannes Ullrich
google.com.my DNS hijack
2013-10-10/a>
Mark Hofman
CSAM Some more unusual scans
2013-10-04/a>
Pedro Bueno
CSAM: WebHosting BruteForce logs
2013-10-02/a>
John Bambenek
Obamacare related domain registration spike, Government shutdown domain registration beginning
2013-09-24/a>
Tom Webb
IDS, NSM, and Log Management with Security Onion 12.04.3
2013-09-11/a>
Alex Stanford
Getting Started with Rsyslog Filters
2013-09-05/a>
Rob VandenBrink
Building Your Own GPU Enabled Private Cloud
2013-09-02/a>
Guy Bruneau
Snort IDS Sensor with Sguil New ISO Released
2013-08-26/a>
Alex Stanford
Stop, Drop and File Carve
2013-08-22/a>
Russ McRee
Read of the Week: A Fuzzy Future in Malware Research
2013-08-21/a>
Alex Stanford
Psst. Your Browser Knows All Your Secrets.
2013-08-19/a>
Rob VandenBrink
ZMAP 1.02 released
2013-08-15/a>
Johannes Ullrich
Microsoft Pulls MS013-061 due to problems with Exchange Server 2013 http://blogs.technet.com/b/exchange/archive/2013/08/14/exchange-2013-security-update-ms13-061-status-update.aspx
2013-08-14/a>
Johannes Ullrich
.GOV zones may not resolve due to DNSSEC problems.
2013-08-14/a>
Johannes Ullrich
Imaging LUKS Encrypted Drives
2013-08-09/a>
Kevin Shortt
Copy Machines - Changing Scanned Content
2013-08-05/a>
Chris Mohan
DMARC: another step forward in the fight against phishing?
2013-07-31/a>
Johannes Ullrich
POP3 Server Brute Forcing Attempts Using Polycom Credentials
2013-07-29/a>
Adrien de Beaupre
BGP multiple banking addresses hijacked
2013-07-28/a>
Guy Bruneau
Wireshark 1.8.9 and 1.10.1 Security Update
2013-07-21/a>
Guy Bruneau
Why use Regular Expressions?
2013-07-20/a>
Manuel Humberto Santander Pelaez
Do you have rogue Internet gateways in your network? Check it with nmap
2013-07-19/a>
Stephen Hall
Cyber Intelligence Tsunami
2013-07-18/a>
Chris Mohan
Blog Spam - annoying junk or a source of intelligence?
2013-07-16/a>
Johannes Ullrich
Why don't we see more examples of web app attacks via POST?
2013-07-13/a>
Lenny Zeltser
Decoy Personas for Safeguarding Online Identity Using Deception
2013-07-10/a>
Johannes Ullrich
.NL Registrar Compromisse
2013-07-08/a>
Richard Porter
Why do we Click?
2013-07-06/a>
Guy Bruneau
Is Metadata the Magic in Modern Network Security?
2013-07-01/a>
Manuel Humberto Santander Pelaez
Using nmap scripts to enhance vulnerability asessment results
2013-06-29/a>
Johannes Ullrich
Instagram "Fruit" Spam
2013-06-22/a>
Guy Bruneau
Facebook Reports a Potential Leak of User Data
2013-06-21/a>
Guy Bruneau
Sysinternals Updates for Autoruns, Strings & ZoomIt http://blogs.technet.com/b/sysinternals/archive/2013/06/20/updates-autoruns-v11-61-strings-v2-52-zoomit-v4-5.aspx
2013-06-18/a>
Russ McRee
EMET 4.0 is now available for download
2013-06-10/a>
Johannes Ullrich
When Google isn't Google
2013-05-23/a>
Adrien de Beaupre
MoVP II
2013-05-22/a>
Adrien de Beaupre
Privilege escalation, why should I care?
2013-05-21/a>
Adrien de Beaupre
Moore, Oklahoma tornado charitable organization scams, malware, and phishing
2013-05-20/a>
Guy Bruneau
Sysinternals Updates for Accesschk, Procdump, RAMMap and Strings http://blogs.technet.com/b/sysinternals/archive/2013/05/17/updates-accesschk-v5-11-procdump-v6-0-rammap-v1-22-strings-v2-51.aspx
2013-05-19/a>
Kevin Shortt
Port 51616 - Got Packets?
2013-05-17/a>
Johannes Ullrich
SSL: Another reason not to ignore IPv6
2013-05-16/a>
Daniel Wesemann
Extracting signatures from Apple .apps
2013-05-08/a>
Chris Mohan
Syria drops from Internet 7th May 2013
2013-05-07/a>
Jim Clausing
Is there an epidemic of typo squatting?
2013-05-07/a>
Jim Clausing
NGINX updates address buffer overflow (CVE-2013-2028) see http://nginx.org/en/CHANGES-1.4
2013-05-04/a>
Kevin Shortt
The Zero-Day Pendulum Swings
2013-04-25/a>
Adam Swanger
Guest Diary: Dylan Johnson - A week in the life of some Perimeter Firewalls
2013-04-23/a>
Russ McRee
Microsoft's Security Intelligence Report (SIRv14) released
2013-04-21/a>
John Bambenek
A Chargen-based DDoS? Chargen is still a thing?
2013-04-17/a>
Richard Porter
Apple iTunes Services Outage
2013-04-16/a>
John Bambenek
Fake Boston Marathon Scams Update
2013-04-15/a>
John Bambenek
Please send any spam (full headers), URLs or other suspicious content scamming off Boston Marathon explosions to handlers@sans.org
2013-04-10/a>
Manuel Humberto Santander Pelaez
Massive Google scam sent by email to Colombian domains
2013-04-04/a>
Johannes Ullrich
Postgresql Patches Critical Vulnerability
2013-03-29/a>
Chris Mohan
Fake Link removal requests
2013-03-27/a>
Adam Swanger
IPv6 Focus Month: Guest Diary: Stephen Groat - IPv6 moving target defense
2013-03-19/a>
Johannes Ullrich
IPv6 Focus Month: The warm and fuzzy side of IPv6
2013-03-18/a>
Kevin Shortt
Spamhaus DDOS
2013-03-07/a>
Guy Bruneau
Apple Blocking Java Web plug-in
2013-03-06/a>
Adam Swanger
IPv6 Focus Month: Guest Diary: Stephen Groat - Geolocation Using IPv6 Addresses
2013-03-02/a>
Scott Fendley
Apple Blocks Older Insecure Versions of Flash Player
2013-02-28/a>
Daniel Wesemann
Parsing Windows Eventlogs in Powershell
2013-02-27/a>
Adam Swanger
Guest Diary: Dylan Johnson - There's value in them there logs!
2013-02-25/a>
Johannes Ullrich
Punkspider enumerates web application vulnerabilities
2013-02-25/a>
Rob VandenBrink
Silent Traitors - Embedded Devices in your Datacenter
2013-02-22/a>
Chris Mohan
PHP 5.4.12 and PHP 5.3.22 released http://www.php.net/ChangeLog-5.php
2013-02-17/a>
Guy Bruneau
HP ArcSight Connector Appliance and Logger Vulnerabilities
2013-02-11/a>
John Bambenek
Is This Chinese Registrar Really Trying to XSS Me?
2013-02-06/a>
Johannes Ullrich
HTTP Range Header and Partial Downloads
2013-02-06/a>
Johannes Ullrich
Are you losing system logging information (and don't know it)?
2013-02-04/a>
Russ McRee
An expose of a recent SANS GIAC XSS vulnerability
2013-02-04/a>
Adam Swanger
SAN Securing The Human Monthly Awareness Video - Advanced Persistent Threat (APT) http://www.securingthehuman.org/resources/ncsam
2013-01-30/a>
Richard Porter
Getting Involved with the Local Community
2013-01-25/a>
Johannes Ullrich
Vulnerability Scans via Search Engines (Request for Logs)
2013-01-15/a>
Rob VandenBrink
When Disabling IE6 (or Java, or whatever) is not an Option...
2013-01-10/a>
Rob VandenBrink
What Else runs Telnets? Or, Pentesters Love Video Conferencing Units Too!
2013-01-09/a>
Rob VandenBrink
Hotmail seeing some temporary access issues
2013-01-02/a>
Chris Mohan
Starting the New Year on the right foot
2012-12-27/a>
John Bambenek
It's 3pm 2 days after Christmas, do you know where your unmanaged SSH keys are?
2012-12-20/a>
Daniel Wesemann
White House strategy on security information sharing and safeguarding
2012-12-18/a>
Dan Goldberg
Mitigating the impact of organizational change: a risk assessment
2012-12-13/a>
Johannes Ullrich
What if Tomorrow Was the Day?
2012-12-06/a>
Daniel Wesemann
Fake tech support calls - revisited
2012-12-06/a>
Daniel Wesemann
Rich Quick Make Money!
2012-12-03/a>
John Bambenek
John McAfee Exposes His Location in Photo About His Being on Run
2012-12-02/a>
Guy Bruneau
Collecting Logs from Security Devices at Home
2012-11-30/a>
Daniel Wesemann
Nmap 6.25 released - lots of new goodies, see http://nmap.org/changelog.html
2012-11-29/a>
Kevin Shortt
New Apple Security Update: APPLE-SA-2012-11-29-1 Apple TV 5.1.1
2012-11-28/a>
Mark Hofman
McAfee releases extraDAT for W32/Autorun.worm.aaeb-h
2012-11-28/a>
Mark Hofman
New version of wireshark is available (1.8.4), some security fixes included.
2012-11-27/a>
Chris Mohan
Can users' phish emails be a security admin's catch of the day?
2012-11-26/a>
John Bambenek
Online Shopping for the Holidays? Tips, News and a Fair Warning
2012-11-23/a>
Rob VandenBrink
What's in Your Change Control Form?
2012-11-20/a>
John Bambenek
Behind the Random NTP Bizarreness of Incorrect Year Being Set
2012-11-20/a>
John Bambenek
Firefox v 17.0 just released, more here: http://www.mozilla.org/en-US/firefox/17.0/releasenotes/
2012-11-19/a>
John Bambenek
MoneyGram fined $100 million for aiding wire fraud - http://krebsonsecurity.com/2012/11/moneygram-fined-100-million-for-wire-fraud/
2012-11-19/a>
John Bambenek
New Poll: Top 5 Unresolved Security Problems of 2012
2012-11-17/a>
Manuel Humberto Santander Pelaez
New Sysinternal Updates: AdExplorer v1.44, Contig v1.7, Coreinfo v3.2, Procdump v5.1. See http://blogs.technet.com/b/sysinternals/archive/2012/11/16/updates-adexplorer-v1-44-contig-v1-7-coreinfo-v3-2-procdump-v5-1.aspx?Redirected=true
2012-11-13/a>
Jim Clausing
Microsoft November 2012 Black Tuesday Update - Overview
2012-11-12/a>
John Bambenek
Request for info: Robocall Phishing Against Local/Regional Banks
2012-11-09/a>
Mark Baggett
Remote Diagnostics with PSR
2012-11-09/a>
Mark Baggett
Fresh batch of Microsoft patches next week
2012-11-08/a>
Daniel Wesemann
Get a 40% discount on your hotel room!
2012-11-07/a>
Mark Baggett
Help eliminate unquoted path vulnerabilities
2012-11-07/a>
Mark Baggett
Multiple 0-Days Reported!
2012-11-07/a>
Mark Baggett
Cisco TACACS+ Authentication Bypass
2012-11-05/a>
Johannes Ullrich
Reminder: Ongoing SMTP Brute Forcing Attacks
2012-11-05/a>
Johannes Ullrich
Possible Fake-AV Ads from Doubleclick Servers
2012-11-04/a>
Lorna Hutcheson
What's important on your network?
2012-10-31/a>
Johannes Ullrich
Cyber Security Awareness Month - Day 31 - Business Continuity and Disaster Recovery
2012-10-30/a>
Johannes Ullrich
Hurricane Sandy Update
2012-10-30/a>
Richard Porter
Splunk 5.0 SP-CAAAHB4 http://www.splunk.com/view/SP-CAAAHB4
2012-10-30/a>
Mark Hofman
Cyber Security Awareness Month - Day 30 - DSD 35 mitigating controls
2012-10-28/a>
Tony Carothers
Firefox 16.02 Released
2012-10-26/a>
Adam Swanger
Securing the Human Special Webcast - October 30, 2012
2012-10-26/a>
Russ McRee
Cyber Security Awareness Month - Day 26 - Attackers use trusted domain to propagate Citadel Zeus variant
2012-10-25/a>
Richard Porter
Cyber Security Awareness Month - Day 25 - Pro Audio & Video Packets on the Wire
2012-10-24/a>
Russ McRee
Ongoing Windstream outage in the midwest - https://twitter.com/search?q=windstream
2012-10-23/a>
Rob VandenBrink
Cyber Security Awareness Month - Day 23: Character Encoding Standards - ASCII and Successors
2012-10-21/a>
Johannes Ullrich
Cyber Security Awareness Month - Day 22: Connectors
2012-10-21/a>
Lorna Hutcheson
Potential Phish for Regular Webmail Accounts
2012-10-19/a>
Johannes Ullrich
Cyber Security Awareness Month - Day 19: Standard log formats and CEE.
2012-10-18/a>
Rob VandenBrink
Cyber Security Awareness Month - Day 18 - Vendor Standards: The vSphere Hardening Guide
2012-10-17/a>
Mark Hofman
Oracle Critical Patch Update October
2012-10-17/a>
Mark Hofman
New Acrobat release (including reader) available. Version 11. Some security improvements more here -->http://blogs.adobe.com/adobereader/
2012-10-16/a>
Richard Porter
CyberAwareness Month - Day 15, Standards Body Soup (pt2), Same Soup Different Cook.
2012-10-16/a>
Johannes Ullrich
Cyber Security Awareness Month - Day 16: W3C and HTML
2012-10-14/a>
Pedro Bueno
Cyber Security Awareness Month - Day 14 - Poor Man's File Analysis System - Part 1
2012-10-09/a>
Johannes Ullrich
Microsoft October 2012 Black Tuesday Update - Overview
2012-10-07/a>
Tony Carothers
Cyber Security Awareness Month - Day 7 - Rollup Review of CSAM Week 1
2012-10-05/a>
Johannes Ullrich
Cyber Security Awareness Month - Day 5: Standards Body Soup, So many Flavors in the bowl.
2012-10-05/a>
Richard Porter
VMWare Security Advisory: VMSA-2012-0014 - http://www.vmware.com/security/advisories/VMSA-2012-0014.html
2012-10-05/a>
Richard Porter
Reports of a Distributed Injection Scan
2012-10-04/a>
Johannes Ullrich
Cyber Security Awareness Month - Day 4: Crypto Standards
2012-10-04/a>
Mark Hofman
And the SHA-3 title goes to .....Keccak
2012-10-03/a>
Kevin Shortt
Fake Support Calls Reported
2012-10-02/a>
Russ McRee
Cyber Security Awareness Month - Day 2 - PCI Security Standard: Mobile Payment Acceptance Security Guidelines
2012-10-01/a>
Johannes Ullrich
Cyber Security Awareness Month
2012-09-28/a>
Joel Esler
Adobe certification revocation for October 4th
2012-09-26/a>
Johannes Ullrich
Some Android phones can be reset to factory default by clicking on links
2012-09-26/a>
Johannes Ullrich
More Java Woes
2012-09-21/a>
Johannes Ullrich
iOS 6 Security Roundup
2012-09-21/a>
Guy Bruneau
Storing your Collection of Malware Samples with Malwarehouse
2012-09-20/a>
Russ McRee
Financial sector advisory: attacks and threats against financial institutions
2012-09-19/a>
Russ McRee
Script kiddie scavenging with Shellbot.S
2012-09-17/a>
Rob VandenBrink
What's on your iPad?
2012-09-14/a>
Lenny Zeltser
Analyzing Malicious RTF Files Using OfficeMalScanner's RTFScan
2012-09-14/a>
Lenny Zeltser
Scam Report - Fake Voice Mail Email Notification Redirects to Malicious Site
2012-09-13/a>
Mark Baggett
Microsoft disrupts traffic associated with the Nitol botnet
2012-09-13/a>
Mark Baggett
More SSL trouble
2012-09-13/a>
Mark Baggett
TCP Fuzzing with Scapy
2012-09-10/a>
Johannes Ullrich
Microsoft Patch Tuesday Pre-Release
2012-09-10/a>
Johannes Ullrich
Godaddy DDoS Attack
2012-09-10/a>
donald smith
Blue Toad publishing co compromise lead to UDID release. http://redtape.nbcnews.com/_news/2012/09/10/13781440-exclusive-the-real-source-of-apple-device-ids-leaked-by-anonymous-last-week?lite
2012-09-09/a>
Guy Bruneau
Phishing/Spam Pretending to be from BBB
2012-09-06/a>
Johannes Ullrich
SSL Requests sent to port 80 (request for help/input)
2012-09-04/a>
Johannes Ullrich
Another round of "Spot the Exploit E-Mail"
2012-09-02/a>
Lorna Hutcheson
Demonstrating the value of your Intrusion Detection Program and Analysts
2012-09-01/a>
Russ McRee
Blackhole targeting Java vulnerability via fake Microsoft Services Agreement email phish
2012-08-31/a>
Russ McRee
Not so fast: Java 7 Update 7 critical vulnerability discovered in less than 24 hours
2012-08-30/a>
Bojan Zdrnja
Analyzing outgoing network traffic (part 2)
2012-08-30/a>
Johannes Ullrich
Editorial: The Slumlord Approach to Network Security http://isc.sans.edu/j/editorial
2012-08-29/a>
Johannes Ullrich
"Data" URLs used for in-URL phishing
2012-08-27/a>
Johannes Ullrich
The Good, Bad and Ugly about Assigning IPv6 Addresses
2012-08-27/a>
Johannes Ullrich
Malware Spam harvesting Facebook Information
2012-08-26/a>
Lorna Hutcheson
Who ya gonna contact?
2012-08-23/a>
Bojan Zdrnja
Analyzing outgoing network traffic
2012-08-22/a>
Adrien de Beaupre
Apple Remote Desktop update fixes no encryption issue
2012-08-22/a>
Adrien de Beaupre
Phishing/spam via SMS
2012-08-21/a>
Adrien de Beaupre
YYABCAFU - Yes Yet Another Bleeping Critical Adobe Flash Update
2012-08-21/a>
Adrien de Beaupre
RuggedCom fails key management 101 on Rugged Operating System (ROS)
2012-08-20/a>
Manuel Humberto Santander Pelaez
Do we need test procedures in our companies before implementing Antivirus signatures?
2012-08-19/a>
Manuel Humberto Santander Pelaez
Authentication Issues between entities during protocol message exchange in SCADA Systems
2012-08-17/a>
Guy Bruneau
Suspicious eFax Spear Phishing Messages
2012-08-14/a>
Rick Wanner
Microsoft August 2012 Black Tuesday Update - Overview
2012-08-12/a>
Tony Carothers
Layers of the Defense-in-Depth Onion
2012-08-12/a>
Tony Carothers
Oracle Security Alert for CVE-2012-3132
2012-08-09/a>
Mark Hofman
Zeus/Citadel variant causing issues in the Netherlands
2012-08-09/a>
Mark Hofman
SQL Injection Lilupophilupop style, Part 2
2012-08-07/a>
Adrien de Beaupre
Who protects small business?
2012-08-05/a>
Daniel Wesemann
Phishing for Payroll with unpatched Java
2012-08-04/a>
Kevin Liston
Vendors: More Patch-Release Options Please
2012-08-01/a>
Johannes Ullrich
Google Chrome 21 and getUserMedia API
2012-07-27/a>
Daniel Wesemann
Cuckoo 0.4 is out - cool new features for malware analysis http://www.cuckoosandbox.org/
2012-07-25/a>
Johannes Ullrich
Microsoft Exchange/Sharepoint and others: Oracle Outside In Vulnerability
2012-07-24/a>
Richard Porter
Wireshark 1.8.1 Released http://www.wireshark.org/
2012-07-24/a>
Richard Porter
Report of spike in DNS Queries gd21.net
2012-07-21/a>
Rick Wanner
TippingPoint DNS Version Request increase
2012-07-20/a>
Mark Baggett
Syria Internet connection cut?
2012-07-19/a>
Mark Baggett
Diagnosing Malware with Resource Monitor
2012-07-19/a>
Mark Baggett
A Heap of Overflows?
2012-07-16/a>
Richard Porter
Sysinternals Update @ http://blogs.technet.com/b/sysinternals/archive/2012/07/16/updates-handle-v3-5-process-explorer-v15-22-process-monitor-v3-03-rammap-v1-21-zoomit-v4-3.aspx
2012-07-16/a>
Jim Clausing
An analysis of the Yahoo! passwords
2012-07-13/a>
Richard Porter
Yesterday (not as on the ball as Rob) at SANSFire
2012-07-13/a>
Russ McRee
2 for 1: SANSFIRE & MSRA presentations
2012-07-13/a>
Russ McRee
Yahoo service SQL injection vuln leads to account exposure
2012-07-12/a>
Rick Wanner
Cisco Security Advisory: Multiple Vulnerabilities in Cisco TelePresence Immersive Endpoint Devices - http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120711-cts
2012-07-12/a>
Rick Wanner
Cisco Security Advisory: Multiple Vulnerabilities in Cisco TelePresence Manager - http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120711-ctsman
2012-07-12/a>
Rick Wanner
Cisco Security Advisory: Multiple Vulnerabilities in Cisco TelePresence Multipoint Switch - http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120711-ctms
2012-07-12/a>
Rick Wanner
Cisco Security Advisory: Multiple Vulnerabilities in Cisco TelePresence Recording Server - http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120711-ctrs
2012-07-11/a>
Rick Wanner
Excellent Security Education Resources
2012-07-09/a>
Johannes Ullrich
The FBI will turn off the Internet on Monday (or not)
2012-07-09/a>
Manuel Humberto Santander Pelaez
Internet Storm Center panel tonight at SANSFIRE 2012!
2012-07-05/a>
Adrien de Beaupre
New OS X trojan backdoor MaControl variant reported
2012-07-02/a>
Joel Esler
A rough guide to keeping your website up
2012-07-02/a>
Joel Esler
Linux & Java leap second bug
2012-06-29/a>
Jim Clausing
Updated SysInternals tools - Autoruns, Process Explorer, Process Monitor, PSKill -- http://blogs.technet.com/b/sysinternals/archive/2012/06/28/updates-autoruns-v11-32-process-explorer-v15-21-process-monitor-v3-02-pskill-v1-15-rammap-v1-2.aspx
2012-06-28/a>
Chris Mohan
Massive spike in BGP traffic - Possible BGP poisoning?
2012-06-27/a>
Daniel Wesemann
What's up with port 79 ?
2012-06-25/a>
Rick Wanner
Targeted Malware for Industrial Espionage?
2012-06-25/a>
Guy Bruneau
Issues with Windows Update Agent
2012-06-22/a>
Kevin Liston
Updated Poll: Which Patch Delivery Schedule Works the Best for You?
2012-06-21/a>
Russ McRee
Analysis of drive-by attack sample set
2012-06-21/a>
Russ McRee
Wireshark 1.8.0 released 21 JUN 2012 http://www.wireshark.org/download.html
2012-06-20/a>
Raul Siles
CVE-2012-0217 (from MS12-042) applies to other environments too
2012-06-19/a>
Daniel Wesemann
Vulnerabilityqueerprocessbrittleness
2012-06-15/a>
Johannes Ullrich
Authenticating E-Mail
2012-06-14/a>
Johannes Ullrich
Spot the Phish: Verizon Wireless
2012-06-10/a>
Scott Fendley
Preying on Users After Major Security Incidents
2012-06-04/a>
Lenny Zeltser
Decoding Common XOR Obfuscation in Malicious Code
2012-06-04/a>
Rob VandenBrink
vSphere 5.0 Hardening Guide Officially Released
2012-05-30/a>
Rob VandenBrink
Too Big to Fail / Too Big to Learn?
2012-05-30/a>
Rob VandenBrink
It's Phishing Season! In fact, it's ALWAYS Phishing Season!
2012-05-25/a>
Guy Bruneau
Apple PGP Product Security key update - https://www.apple.com/support/security/pgp/
2012-05-25/a>
Guy Bruneau
Google Publish Transparency Report
2012-05-23/a>
Mark Baggett
Problems with MS12-035 affecting XP, SBS and Windows 2003?
2012-05-16/a>
Johannes Ullrich
New Version of Google Chrome released (19.0.1084.46)
2012-05-14/a>
Chris Mohan
Laptops at Security Conferences
2012-05-06/a>
Jim Clausing
Tool updates and Win 8
2012-05-02/a>
Bojan Zdrnja
Monitoring VMWare logs
2012-04-30/a>
Rob VandenBrink
FCC posts Enquiry Documents on Google Wardriving
2012-04-23/a>
Russ McRee
Emergency Operations Centers & Security Incident Management: A Correlation
2012-04-21/a>
Guy Bruneau
WordPress Release Security Update
2012-04-16/a>
Mark Baggett
Challenge: What can you do with Funky Directory Names (Part 2)
2012-04-11/a>
Mark Baggett
Challenge: What can you do with funky directory names?
2012-04-08/a>
Chris Mohan
Blog Log: More noise or a rich source of intelligence?
2012-04-06/a>
Johannes Ullrich
Social Share Privacy
2012-04-05/a>
Johannes Ullrich
Evil hides everywhere: Web Application Exploits in Headers
2012-04-02/a>
Johannes Ullrich
SHA 1-2-3
2012-03-27/a>
Guy Bruneau
Wireshark 1.6.6 and 1.4.2 Released
2012-03-27/a>
Guy Bruneau
Opera 11.62 for Windows patch several bugs and vulnerabilities - http://www.opera.com/docs/changelogs/windows/1162/
2012-03-16/a>
Swa Frantzen
INFOCON Yellow - Microsoft RDP - MS12-020
2012-02-29/a>
Johannes Ullrich
COX Network Outage
2012-02-24/a>
Guy Bruneau
Flashback Trojan in the Wild
2012-02-23/a>
donald smith
DNS-Changer "clean DNS" extension requested
2012-02-20/a>
Rick Wanner
DNSChanger resolver shutdown deadline is March 8th
2012-02-20/a>
Johannes Ullrich
The Ultimate OS X Hardening Guide Collection
2012-02-20/a>
Pedro Bueno
Simple Malware Research Tools
2012-01-31/a>
Russ McRee
OSINT tactics: parsing from FOCA for Maltego
2012-01-24/a>
Bojan Zdrnja
Is it time to get rid of NetBIOS?
2012-01-22/a>
Lorna Hutcheson
Mailbag - "Attacks"
2012-01-13/a>
Guy Bruneau
New Generic Top-Level Domains (gTLDs) out for Sale
2012-01-12/a>
Rob VandenBrink
Stuff I Learned Scripting - Fun with STDERR
2011-12-25/a>
Deborah Hale
Merry Christmas, Happy Holidays
2011-12-12/a>
Daniel Wesemann
You won 100$ or a free iPad!
2011-11-28/a>
Tom Liston
A Puzzlement...
2011-11-19/a>
Kevin Liston
Monitoring your Log Monitoring Process
2011-11-16/a>
Adrien de Beaupre
GET BACK TO ME ASAP
2011-11-11/a>
Rick Wanner
What's up with fbi.gov DNS?
2011-11-10/a>
Rob VandenBrink
Stuff I Learned Scripting - - Parsing XML in a One-Liner
2011-11-09/a>
Russ McRee
Operation Ghost Click: FBI bags crime ring responsible for $14 million in losses
2011-11-07/a>
Rob VandenBrink
Juniper BGP issues causing locallized Internet Problems
2011-10-28/a>
Russ McRee
Critical Control 19: Data Recovery Capability
2011-10-26/a>
Rick Wanner
Critical Control 17:Penetration Tests and Red Team Exercises
2011-10-26/a>
Rob VandenBrink
The Theoretical "SSL Renegotiation" Issue gets a Whole Lot More Real !
2011-10-25/a>
Chris Mohan
Recurring reporting made easy?
2011-10-21/a>
Johannes Ullrich
New Flash Click Jacking Exploit
2011-10-17/a>
Rob VandenBrink
Critical Control 11: Account Monitoring and Control
2011-10-10/a>
Tom Liston
What's In A Name?
2011-09-29/a>
Daniel Wesemann
The SSD dilemma
2011-09-27/a>
donald smith
New feature in JUNOS to drop or ignore path attributes.
2011-09-20/a>
Swa Frantzen
Diginotar declared bankrupt
2011-09-19/a>
Guy Bruneau
MS Security Advisory Update - Fraudulent DigiNotar Certificates
2011-09-18/a>
Guy Bruneau
Google Chrome Security Updates
2011-09-15/a>
Swa Frantzen
DigiNotar looses their accreditation for qualified certificates
2011-09-13/a>
Swa Frantzen
GlobalSign back in operation
2011-09-13/a>
Swa Frantzen
More DigiNotar intermediate certificates blocklisted at Microsoft
2011-09-09/a>
Johannes Ullrich
Large power outage in Southern California may last until Friday. http://www.sdge.com
2011-09-07/a>
Lenny Zeltser
Analyzing Mobile Device Malware - Honeynet Forensic Challenge 9 and Some Tools
2011-09-07/a>
Lenny Zeltser
GlobalSign Temporarily Stops Issuing Certificates to Investigate a Potential Breach
2011-09-06/a>
Swa Frantzen
DigiNotar audit - intermediate report available
2011-09-06/a>
Johannes Ullrich
Microsoft Releases Diginotar Related Patch and Advisory
2011-09-01/a>
Swa Frantzen
DigiNotar breach - the story so far
2011-08-31/a>
Johannes Ullrich
Firefox/Thunderbird 6.0.1 released to blocklist bad DigiNotar SSL certificates
2011-08-31/a>
Johannes Ullrich
Phishing e-mail to custom e-mail addresses
2011-08-31/a>
Johannes Ullrich
Kernel.org Compromise
2011-08-26/a>
Daniel Wesemann
User Agent 007
2011-08-24/a>
Rob VandenBrink
Google Chrome 13.0.782.215 Released, several security updates ==> http://googlechromereleases.blogspot.com/2011/08/stable-channel-update_22.html
2011-08-24/a>
Rob VandenBrink
Citrix Access Gateway Cross Site Scripting vulnerability and fix ==> http://support.citrix.com/article/CTX129971
2011-08-17/a>
Rob VandenBrink
Putting all of Your Eggs in One Basket - or How NOT to do Layoffs
2011-08-16/a>
Scott Fendley
Phishing Scam Victim Response
2011-08-15/a>
Rob VandenBrink
8 Years since the Eastern Seaboard Blackout - Has it Been that Long?
2011-08-08/a>
Rob VandenBrink
Ping is Bad (Sometimes)
2011-08-05/a>
donald smith
New Mac Trojan: BASH/QHost.WB
2011-08-03/a>
Johannes Ullrich
Malicious Images: What's a QR Code
2011-07-21/a>
Mark Hofman
Lion Released
2011-07-17/a>
Mark Hofman
SSH Brute Force
2011-07-13/a>
Guy Bruneau
New Sguil HTTPRY Agent
2011-07-09/a>
Tony Carothers
Copyright Alert System - What say you?
2011-07-09/a>
Johannes Ullrich
Updated PGP key for blocklist added to https://isc.sans.edu/PGPKEYS.txt
2011-07-07/a>
Rob VandenBrink
"There's a Patch for that" (or maybe not)
2011-07-06/a>
Rob VandenBrink
"Too Important to Patch" - Wait? What?
2011-07-03/a>
Deborah Hale
Business Continuation in the Face of Disaster
2011-06-28/a>
Johannes Ullrich
Update: Google Chrome 12.0.742.112 released http://googlechromereleases.blogspot.com/2011/06/stable-channel-update_28.html
2011-06-26/a>
Rick Wanner
Nagios script for ISC threat level http://www.aj-services.com/?p=275
2011-06-22/a>
Guy Bruneau
How Good is your Employee Termination Policy?
2011-06-21/a>
Chris Mohan
Australian government security audit report shows tough love to agencies
2011-06-20/a>
Chris Mohan
Log files - are you reviewing yours?
2011-06-19/a>
Guy Bruneau
Sega Pass Compromised - 1.29 Million Customers Data Leaked
2011-06-17/a>
Richard Porter
When do you stop owning Technology?
2011-06-13/a>
Bojan Zdrnja
Harry Potter and the Rogue anti-virus: Part 1
2011-06-12/a>
Mark Hofman
Cloud thoughts
2011-06-08/a>
Johannes Ullrich
Spam from compromised Hotmail accounts
2011-06-06/a>
Manuel Humberto Santander Pelaez
Phishing: Same goal, same techniques and people still falling for such scams
2011-05-25/a>
Lenny Zeltser
Monitoring Social Media for Security References to Your Organization
2011-05-19/a>
Daniel Wesemann
Fake AV Bingo
2011-05-17/a>
Johannes Ullrich
A Couple Days of Logs: Looking for the Russian Business Network
2011-05-11/a>
Swa Frantzen
Time to disable WebGL ?
2011-05-10/a>
Swa Frantzen
Changing MO in scamming our users ?
2011-05-06/a>
Richard Porter
Updated Exploit Index for Microsoft
2011-04-28/a>
Chris Mohan
Gathering and use of location information fears - or is it all a bit too late
2011-04-26/a>
John Bambenek
Is the Insider Threat Really Over?
2011-04-25/a>
Rob VandenBrink
Sony PlayStation Network Outage - Day 5
2011-04-23/a>
Manuel Humberto Santander Pelaez
Image search can lead to malware download
2011-04-22/a>
Manuel Humberto Santander Pelaez
iPhoneMap: iPhoneTracker port to Linux
2011-04-21/a>
Guy Bruneau
Silverlight Update Available
2011-04-20/a>
Johannes Ullrich
iPhone GPS Data Storage
2011-04-11/a>
Johannes Ullrich
GMail User Using 2FA Warned of Access From China
2011-04-07/a>
Chris Mohan
Being a good internet neighbour
2011-04-03/a>
Richard Porter
Extreme Disclosure? Not yet but a great trend!
2011-03-29/a>
Daniel Wesemann
Making sense of RSA ACE server audit logs
2011-03-22/a>
Chris Mohan
Read only USB stick trick
2011-03-14/a>
Bojan Zdrnja
Tsunami in Japan and self modifying RogueAV code
2011-03-11/a>
Guy Bruneau
Snort IDS Sensor with Sguil Framework ISO
2011-03-09/a>
Kevin Shortt
AVG Anti-Virus 2011 False Positives - Luhe.Exploit.PDF.B
2011-03-07/a>
Bojan Zdrnja
Oracle padding attacks (Codegate crypto 400 writeup)
2011-03-03/a>
Manuel Humberto Santander Pelaez
Rogue apps inside Android Marketplace
2011-02-28/a>
Deborah Hale
Possible Botnet Scanning
2011-02-22/a>
Bojan Zdrnja
HBGary hack: lessons learned
2011-02-11/a>
Kevin Johnson
Two-Factor Auth: Can we just Google the response?
2011-02-09/a>
Mark Hofman
Adobe Patches (shockwave, Flash, Reader & Coldfusion)
2011-02-08/a>
Johannes Ullrich
Tippingpoint Releases Details on Unpatched Bugs
2011-02-07/a>
Richard Porter
Crime is still Crime! Pt 2
2011-02-02/a>
Johannes Ullrich
Having Phish on Friday
2011-01-30/a>
Richard Porter
The Modern Dark Ages?
2011-01-29/a>
Mark Hofman
Sourceforge attack
2011-01-25/a>
Chris Mohan
Reviewing our preconceptions
2011-01-24/a>
Rob VandenBrink
Where have all the COM Ports Gone? - How enumerating COM ports led to me finding a “misplaced” Microsoft tool
2011-01-13/a>
Rob VandenBrink
Is Infosec seeing "Death by a Thousand Budget Cuts"?
2011-01-13/a>
Rob VandenBrink
Google Chrome 8.0.552.237 and Chrome OS 8.0.552.334 released ==> http://googlechromereleases.blogspot.com/2011/01/chrome-stable-release.html and http://www.kb.cert.org/vuls/id/258423
2011-01-12/a>
Richard Porter
Has Big Brother gone Global?
2011-01-12/a>
Richard Porter
Yet Another Data Broker? AOL Lifestream.
2011-01-10/a>
Manuel Humberto Santander Pelaez
VirusTotal VTzilla firefox/chrome plugin
2010-12-30/a>
Rick Wanner
Obvious Lessons from the Skype outage
2010-12-29/a>
Daniel Wesemann
Beware of strange web sites bearing gifts ...
2010-12-24/a>
Daniel Wesemann
A question of class
2010-12-23/a>
Mark Hofman
Skoudis' Annual Xmas Hacking Challenge - The Nightmare Before Charlie Brown's Christmas
2010-12-23/a>
Mark Hofman
White house greeting cards
2010-12-22/a>
John Bambenek
IIS 7.5 0-Day DoS (processing FTP requests)
2010-12-15/a>
Manuel Humberto Santander Pelaez
HP StorageWorks P2000 G3 MSA hardcoded user
2010-12-13/a>
Deborah Hale
Gawker Media Breach of Security
2010-12-10/a>
Mark Hofman
Microsoft patches
2010-12-03/a>
Mark Hofman
AVG Update Bricking windows 7 64 bit
2010-11-29/a>
Stephen Hall
iPhone phishing - What you see, isn't what you get
2010-11-26/a>
Mark Hofman
Using password cracking as metric/indicator for the organisation's security posture
2010-11-24/a>
Bojan Zdrnja
Privilege escalation 0-day in almost all Windows versions
2010-11-22/a>
Lenny Zeltser
Brand Impersonations On-Line: Brandjacking and Social Networks
2010-11-19/a>
Jason Lam
Exchanging and sharing of assessment results
2010-11-18/a>
Chris Carboni
Stopping the ZeroAccess Rootkit
2010-11-17/a>
Guy Bruneau
Reference on Open Source Digital Forensics
2010-11-17/a>
Guy Bruneau
Cisco Unified Videoconferencing Affected by Multiple Vulnerabilities
2010-11-12/a>
Guy Bruneau
Honeynet Forensic Challenge - Analyzing Malicious Portable Destructive Files
2010-11-11/a>
Johannes Ullrich
OS X 10.6.5 released with security patches. Careful: issues with PGP WDE! (see PGP support forums)
2010-11-02/a>
Johannes Ullrich
Limited Malicious Search Engine Poisoning for Election
2010-10-26/a>
Pedro Bueno
Be (even more) careful with public hotspots. Firesheep released yesterday. Brilliant and scary.
2010-10-22/a>
Manuel Humberto Santander Pelaez
Intypedia project
2010-10-20/a>
Jim Clausing
Tools updates - Oct 2010
2010-10-11/a>
Adrien de Beaupre
OT: Happy Thanksgiving Day Canada
2010-10-04/a>
Mark Hofman
Online Voting
2010-10-03/a>
Adrien de Beaupre
Canada's Cyber Security Strategy released today
2010-09-28/a>
Daniel Wesemann
Supporting the economy (in Russia and Ukraine)
2010-09-16/a>
Johannes Ullrich
Facebook "Like Pages"
2010-09-14/a>
Adrien de Beaupre
BlackEnergy DDoS
2010-09-07/a>
Bojan Zdrnja
SSH password authentication insight and analysis by DRG
2010-08-27/a>
Mark Hofman
FTP Brute Password guessing attacks
2010-08-23/a>
Manuel Humberto Santander Pelaez
Firefox plugins to perform penetration testing activities
2010-08-23/a>
Bojan Zdrnja
DLL hijacking vulnerabilities
2010-08-19/a>
Rob VandenBrink
Change is Good. Change is Bad. Change is Life.
2010-08-17/a>
Bojan Zdrnja
Do you like Bing? So do the RogueAV guys!
2010-08-16/a>
Raul Siles
Blind Elephant: A New Web Application Fingerprinting Tool
2010-08-13/a>
Guy Bruneau
Shadowserver Binary Whitelisting Service
2010-08-10/a>
Daniel Wesemann
SSH - new brute force tool?
2010-08-07/a>
Stephen Hall
Countdown to Tuesday...
2010-08-04/a>
Tom Liston
Incident Reporting - Liston's "How-To" Guide
2010-08-03/a>
Johannes Ullrich
When Lightning Strikes
2010-07-29/a>
Rob VandenBrink
Snort 2.8.6.1 and Snort 2.9 Beta Released
2010-07-24/a>
Manuel Humberto Santander Pelaez
GnuPG gpgsm bug
2010-07-24/a>
Manuel Humberto Santander Pelaez
Transmiting logon information unsecured in the network
2010-07-20/a>
Manuel Humberto Santander Pelaez
Lowering infocon back to green
2010-07-18/a>
Manuel Humberto Santander Pelaez
SAGAN: An open-source event correlation system - Part 1: Installation
2010-07-18/a>
Manuel Humberto Santander Pelaez
New metasploit GUI written in Java
2010-07-13/a>
Jim Clausing
Forensic challenge results
2010-07-13/a>
Jim Clausing
VMware Studio Security Update
2010-07-07/a>
Kevin Shortt
Facebook, Facebook, What Do YOU See?
2010-07-04/a>
Manuel Humberto Santander Pelaez
Interesting analysis of the PHP SplObjectStorage Vulnerability
2010-07-01/a>
Bojan Zdrnja
Down the RogueAV and Blackhat SEO rabbit hole (part 2)
2010-06-29/a>
donald smith
Interesting idea to help prevent RogueAV from using SEO without being noticed:)
2010-06-28/a>
Bojan Zdrnja
Down the RogueAV and Blackhat SEO rabbit hole
2010-06-27/a>
Manuel Humberto Santander Pelaez
Study of clickjacking vulerabilities on popular sites
2010-06-21/a>
Adrien de Beaupre
GoDaddy Scam/Phish/Spam
2010-06-16/a>
Kevin Shortt
Maltego 3
2010-06-15/a>
Manuel Humberto Santander Pelaez
iPhone 4 Order Security Breach Exposes Private Information
2010-06-14/a>
Manuel Humberto Santander Pelaez
New way of social engineering on IRC
2010-06-14/a>
Manuel Humberto Santander Pelaez
Another way to get protection for application-level attacks
2010-06-14/a>
Manuel Humberto Santander Pelaez
Rogue facebook application acting like a worm
2010-06-11/a>
Mark Hofman
ollydbg your favourite debugger version 2.0 is released If you downloaded on 2 or 3 June you'll need the fixed version from June 4. 32 bit only at this stage. 64 bit is planned for 2.01
2010-06-10/a>
Deborah Hale
Top 5 Social Networking Media Risks
2010-06-06/a>
Manuel Humberto Santander Pelaez
Nice OS X exploit tutorial
2010-06-04/a>
Rick Wanner
New Honeynet Project Forensic Challenge
2010-06-02/a>
Bojan Zdrnja
Clickjacking attacks on Facebook's Like plugin
2010-05-25/a>
donald smith
Face book “joke” leads to firing.
2010-05-22/a>
Rick Wanner
SANS 2010 Digital Forensics Summit - APT Based Forensic Challenge
2010-05-21/a>
Rick Wanner
2010 Digital Forensics and Incident Response Summit
2010-05-19/a>
Jason Lam
EFF paper about browser tracking
2010-05-15/a>
Deborah Hale
Google Acknowledges Grabbing Personal Data
2010-05-07/a>
Rob VandenBrink
Security Awareness – Many Audiences, Many Messages (Part 2)
2010-05-06/a>
Rick Wanner
Learn about web app hacking and defense
2010-05-04/a>
Rick Wanner
SIFT review in the ISSA Toolsmith
2010-05-02/a>
Mari Nichols
Zbot Social Engineering
2010-04-29/a>
Bojan Zdrnja
Who needs exploits when you have social engineering?
2010-04-21/a>
Guy Bruneau
McAfee DAT 5958 Update Issues
2010-04-21/a>
Guy Bruneau
Google Chrome Security Update v4.1.249.1059 Released: http://googlechromereleases.blogspot.com/2010/04/stable-update-security-fixes.html
2010-04-20/a>
Raul Siles
Are You Ready for a Transportation Collapse...?
2010-04-19/a>
Daniel Wesemann
Linked into scams?
2010-04-14/a>
Mark Hofman
And let the patching games continue
2010-04-13/a>
Adrien de Beaupre
Web App Testing Tools
2010-04-13/a>
Johannes Ullrich
More Legal Threat Malware E-Mail
2010-04-12/a>
Adrien de Beaupre
Get yer bogons out!
2010-04-10/a>
Andre Ludwig
New bug/exploit for javaws
2010-04-09/a>
Mark Hofman
Outage Update - isc.sans.org
2010-04-07/a>
Johannes Ullrich
our primary datacenter is currently experiencing a network outage
2010-04-06/a>
Daniel Wesemann
Application Logs
2010-04-04/a>
Mari Nichols
Financial Management of Cyber Risk
2010-03-30/a>
Marcus Sachs
Zigbee Analysis Tools
2010-03-28/a>
Rick Wanner
Honeynet Project: 2010 Forensic Challenge #3
2010-03-27/a>
Guy Bruneau
Create a Summary of IP Addresses from PCAP Files using Unix Tools
2010-03-24/a>
Kyle Haugsness
Wikipedia outage
2010-03-18/a>
Bojan Zdrnja
Dangers of copy&paste
2010-03-15/a>
Adrien de Beaupre
Spamassassin Milter Plugin Remote Root Attack
2010-03-10/a>
Rob VandenBrink
What's My Firewall Telling Me? (Part 4)
2010-03-06/a>
Tony Carothers
Integration and the Security of New Technologies
2010-03-05/a>
Kyle Haugsness
What is your firewall log telling you - responses
2010-02-26/a>
Rick Wanner
New version of FireBug Firefox plug-in - http://getfirebug.com/
2010-02-23/a>
Mark Hofman
What is your firewall telling you and what is TCP249?
2010-02-22/a>
Rob VandenBrink
New Risks in Penetration Testing
2010-02-20/a>
Mari Nichols
Is "Green IT" Defeating Security?
2010-02-17/a>
Rob VandenBrink
Defining Clouds - " A Cloud by any Other Name Would be a Lot Less Confusing"
2010-02-17/a>
Rob VandenBrink
Cisco Security Agent Security Updates: cisco-sa-20100217-csa
2010-02-15/a>
Johannes Ullrich
Various Olympics Related Dangerous Google Searches
2010-02-13/a>
Lorna Hutcheson
Network Traffic Analysis in Reverse
2010-02-10/a>
Johannes Ullrich
Twitpic, EXIF and GPS: I Know Where You Did it Last Summer
2010-02-06/a>
Guy Bruneau
Oracle WebLogic Server Security Alert
2010-02-03/a>
Rob VandenBrink
Support for Legacy Browsers
2010-02-02/a>
Johannes Ullrich
Twitter Mass Password Reset due to Phishing
2010-02-01/a>
Rob VandenBrink
NMAP 5.21 - Is UDP Protocol Specific Scanning Important? Why Should I Care?
2010-01-29/a>
Johannes Ullrich
Analyzing isc.sans.org weblogs, part 2, RFI attacks
2010-01-27/a>
Raul Siles
European Union Security Challenge (Campus Party 2010)
2010-01-26/a>
Rob VandenBrink
VMware vSphere Hardening Guide Draft posted for public review
2010-01-20/a>
Johannes Ullrich
Weathering the Storm Part 1: An analysis of our SANS ISC weblogs http://appsecstreetfighter.com
2010-01-19/a>
Jim Clausing
Forensic challenges
2010-01-14/a>
Bojan Zdrnja
Rogue AV exploiting Haiti earthquake
2010-01-14/a>
Bojan Zdrnja
DRG (Dragon Research Group) Distro available for general release
2010-01-09/a>
G. N. White
What's Up With All The Port Scanning Using TCP/6000 As A Source Port?
2010-01-06/a>
Guy Bruneau
Secure USB Flaw Exposed
2009-12-30/a>
Guy Bruneau
Ready to use IDS Sensor with Sguil
2009-12-28/a>
Johannes Ullrich
8 Basic Rules to Implement Secure File Uploads http://jbu.me/48 (inspired by IIS ; bug)
2009-12-17/a>
Daniel Wesemann
overlay.xul is back
2009-12-16/a>
Rob VandenBrink
Beware the Attack of the Christmas Greeting Cards !
2009-12-09/a>
Swa Frantzen
OSSEC 2.3 released
2009-12-04/a>
Daniel Wesemann
The economics of security advice (MSFT research paper)
2009-11-29/a>
Patrick Nolan
A Cloudy Weekend
2009-11-24/a>
John Bambenek
BIND Security Advisory (DNSSEC only)
2009-11-24/a>
Johannes Ullrich
The ISC and DShield websites will be unavailable on Wednesday Nov 25th from 8-8:30 am EST.
2009-11-13/a>
Adrien de Beaupre
TLS & SSLv3 renegotiation vulnerability explained
2009-11-13/a>
Adrien de Beaupre
Flash Origin Policy Attack
2009-11-09/a>
Chris Carboni
80's Flashback on Jailbroken iPhones
2009-11-08/a>
Kevin Liston
Even More Thoughts on Legacy Systems
2009-11-05/a>
Swa Frantzen
Legacy systems
2009-11-02/a>
Rob VandenBrink
Microsoft releases v1.02 of Enhanced Mitigation Evaluation Toolkit (EMET)
2009-10-26/a>
Johannes Ullrich
Web honeypot Update
2009-10-26/a>
Johannes Ullrich
Today: ISC Login bugfix day. If you have issues logging in using OpenID, please email a copy of your OpenID URL to jullrich\at\sans.edu
2009-10-23/a>
donald smith
Cyber Security Awareness Month - Day 23 port 179 TCP - Border Gateway Protocol
2009-10-19/a>
Daniel Wesemann
Scam Email
2009-10-17/a>
Rick Wanner
Mozilla disables Microsoft plug-ins?
2009-10-17/a>
Rick Wanner
Unusual traffic from Loopback to Unused ARIN address
2009-10-16/a>
Adrien de Beaupre
Disable MS09-054 patch, or Firefox Plugin?
2009-10-15/a>
Deborah Hale
Yet another round of Viral Spam
2009-10-13/a>
Daniel Wesemann
Adobe Reader and Acrobat - Black Tuesday continues
2009-10-08/a>
Johannes Ullrich
Firefox Plugin Collections
2009-10-02/a>
Stephen Hall
New SysInternal fun for the weekend
2009-09-27/a>
Stephen Hall
Use Emerging Threats signatures? READ THIS!
2009-09-25/a>
Deborah Hale
Malware delivered over Google and Yahoo Ad's?
2009-09-17/a>
Bojan Zdrnja
Why is Rogue/Fake AV so successful?
2009-09-01/a>
Guy Bruneau
Gmail Down
2009-08-31/a>
Pedro Bueno
Microsoft IIS 5/6 FTP 0Day released
2009-08-28/a>
Adrien de Beaupre
apache.org compromised
2009-08-26/a>
Johannes Ullrich
Cisco over-the-air-provisioning skyjacking exploit
2009-08-19/a>
Daniel Wesemann
Checking your protection
2009-08-18/a>
Deborah Hale
Domain tcpdump.org unavailable
2009-08-18/a>
Deborah Hale
Website compromises - what's happening?
2009-08-13/a>
Jim Clausing
New and updated cheat sheets
2009-08-03/a>
Mark Hofman
Switch hardening on your network
2009-07-31/a>
Deborah Hale
Google Safe Browsing
2009-07-27/a>
Raul Siles
New Hacker Challenge: Prison Break - Breaking, Entering & Decoding
2009-07-17/a>
John Bambenek
Cross-Platform, Cross-Browser DoS Vulnerability
2009-07-13/a>
Adrien de Beaupre
Security Update available for Wyse Device Manager
2009-07-11/a>
Marcus Sachs
Imageshack
2009-07-02/a>
Daniel Wesemann
Unpatched Bloatware on new PCs
2009-07-02/a>
Daniel Wesemann
Time to update updating on PCs for 3rd party apps
2009-06-26/a>
Mark Hofman
PHPMYADMIN scans
2009-06-24/a>
Kyle Haugsness
TCP scanning increase for 4899
2009-06-21/a>
Bojan Zdrnja
Apache HTTP DoS tool mitigation
2009-06-16/a>
John Bambenek
Iran Internet Blackout: Using Twitter for Operational Intelligence
2009-06-16/a>
John Bambenek
URL Shortening Service Cligs Hacked
2009-06-12/a>
Adrien de Beaupre
Google updates for Chrome
2009-06-12/a>
Adrien de Beaupre
Green Dam
2009-06-11/a>
Rick Wanner
MIR-ROR Motile Incident Response - Respond Objectively Remediate
2009-06-11/a>
Rick Wanner
WHO Declares Flu A(H1N1) a Pandemic
2009-06-09/a>
Swa Frantzen
Adobe June Black Tuesday upgrades
2009-06-04/a>
Raul Siles
Targeted e-mail attacks asking to verify wire transfer details
2009-06-01/a>
G. N. White
Yet another "Digital Certificate" malware campaign
2009-05-28/a>
Jim Clausing
Stego in TCP retransmissions
2009-05-24/a>
Raul Siles
Facebook phising using Belgium (.be) domains
2009-05-22/a>
Mark Hofman
Patching and Apple - Java issue
2009-05-22/a>
Mark Hofman
Patching and Adobe
2009-05-21/a>
Adrien de Beaupre
Gumblar analysis and writeup
2009-05-19/a>
Rick Wanner
New Version of Mandiant Highlighter
2009-05-18/a>
Rick Wanner
Cisco SAFE Security Reference Guide Updated
2009-05-18/a>
Rick Wanner
JSRedir-R/Gumblar badness
2009-05-12/a>
Swa Frantzen
Apple patches and updates
2009-05-04/a>
Tom Liston
Facebook phishing malware
2009-05-01/a>
Adrien de Beaupre
Incident Management
2009-04-26/a>
Johannes Ullrich
Odd DNS Resolution for Google via OpenDNS
2009-04-24/a>
Pedro Bueno
Did you check your conference goodies?
2009-04-21/a>
Bojan Zdrnja
Web application vulnerabilities
2009-04-20/a>
Jason Lam
Digital Content on TV
2009-04-16/a>
Adrien de Beaupre
Incident Response vs. Incident Handling
2009-04-16/a>
Adrien de Beaupre
Strange Windows Event Log entry
2009-04-10/a>
Stephen Hall
Hosted javascript leading to .cn PDF malware
2009-04-09/a>
Johannes Ullrich
Conficker update with payload
2009-04-03/a>
Johannes Ullrich
Cyber Security Act of 2009
2009-04-02/a>
Handlers
A view from the CWG Trenches
2009-03-27/a>
Mark Hofman
There is some SMiShing going on in the EU
2009-03-26/a>
Mark Hofman
Webhoneypot fun
2009-03-20/a>
donald smith
Stealthier then a MBR rootkit, more powerful then ring 0 control, it’s the soon to be developed SMM root kit.
2009-03-11/a>
Bojan Zdrnja
Massive ARP spoofing attacks on web sites
2009-03-10/a>
Swa Frantzen
Browser plug-ins, transparent proxies and same origin policies
2009-03-01/a>
Jim Clausing
Cool combination of tools
2009-02-25/a>
Swa Frantzen
Targeted link diversion attempts
2009-02-24/a>
G. N. White
Gmail Access Issues Early This AM
2009-02-20/a>
Mark Hofman
Phishing with a small twist
2009-02-05/a>
Rick Wanner
Mandiant Memoryze review, Hilighter, other Mandiant tools!
2009-02-01/a>
Chris Carboni
Scanning for Trixbox vulnerabilities
2009-01-31/a>
Swa Frantzen
DNS DDoS - let's use a long term solution
2009-01-31/a>
John Bambenek
Google Search Engine's Malware Detection Broken
2009-01-20/a>
Adrien de Beaupre
Obamamania
2009-01-18/a>
Maarten Van Horenbeeck
Targeted social engineering
2009-01-12/a>
William Salusky
Web Application Firewalls (WAF) - Have you deployed WAF technology?
2009-01-11/a>
Deborah Hale
The Frustration of Phishing Attacks
2009-01-09/a>
Johannes Ullrich
SANS Log Management Survey
2009-01-07/a>
William Salusky
BIND 9.x security patch - resolves potentially new DNS poisoning vector
2009-01-04/a>
Rick Wanner
Twitter/Facebook Phishing Attempt
2008-12-28/a>
Raul Siles
Level3 Outage?
2008-12-28/a>
Raul Siles
AT&T Wireless Outage
2008-12-12/a>
Swa Frantzen
Browser Security Handbook
2008-12-02/a>
Deborah Hale
Sonicwall License Manager Failure
2008-11-25/a>
Andre Ludwig
OS X Dns Changers part three
2008-11-25/a>
Andre Ludwig
Tmobile G1 handsets having DNS problems?
2008-11-25/a>
Andre Ludwig
The beginnings of a collaborative approach to IDS
2008-11-12/a>
John Bambenek
Thoughts on Security Intelligence (McColo Corp alleged spam/malware host knocked offline)
2008-11-11/a>
Swa Frantzen
Phishing for Google adwords
2008-11-05/a>
donald smith
If you missed President Elect Obamas speech have some malware instead
2008-11-02/a>
Adrien de Beaupre
Daylight saving time
2008-10-31/a>
Rick Wanner
Sprint-Cogent Peering Issue
2008-10-31/a>
Rick Wanner
Day 31 - Legal Awareness
2008-10-30/a>
Kevin Liston
Making Intelligence Actionable: Part 2
2008-10-29/a>
Deborah Hale
Day 29 - Should I Switch Software Vendors?
2008-10-29/a>
Deborah Hale
Enom Phishing - Caution Enom Registrars
2008-10-20/a>
Raul Siles
Google Webmaster Tools warning about hackable sites
2008-10-20/a>
Johannes Ullrich
Fraudulent ATM Reactivation Phone Calls.
2008-10-17/a>
Patrick Nolan
Day 17 - Containing a DNS Hijacking
2008-10-10/a>
Marcus Sachs
Fake Microsoft Update Email
2008-10-08/a>
Johannes Ullrich
Domaincontrol (GoDaddy) Nameservers DNS Poisoning
2008-10-07/a>
Kyle Haugsness
Cogent peering problems
2008-09-22/a>
Maarten Van Horenbeeck
Data exfiltration and the use of anonymity providers
2008-09-20/a>
Rick Wanner
New (to me) nmap Features
2008-09-18/a>
Bojan Zdrnja
Monitoring HTTP User-Agent fields
2008-09-16/a>
donald smith
Don't open that invoice.zip file its not from UPS
2008-09-03/a>
donald smith
New bgp hijack isn't very new.
2008-08-19/a>
Johannes Ullrich
A morning stroll through my web logs
2008-08-15/a>
Jim Clausing
OMFW 2008 reflections
2008-08-14/a>
Mari Nichols
SBC Outage?
2008-08-09/a>
Deborah Hale
Cleveland Outage
2008-08-05/a>
Daniel Wesemann
Watching those DNS logs
2008-08-02/a>
Maarten Van Horenbeeck
A little of that human touch
2008-07-29/a>
Kyle Haugsness
Google SSL cert expired for POP/IMAP users
2008-07-18/a>
Adrien de Beaupre
Exit process?
2008-07-11/a>
Jim Clausing
And you thought the DNS issue was an old one...
2008-07-09/a>
Johannes Ullrich
Unpatched Word Vulnerability
2008-07-08/a>
Swa Frantzen
Security implications in HVAC equipment
2008-07-08/a>
Johannes Ullrich
Mulitple Vendors DNS Spoofing Vulnerability
2008-07-07/a>
Pedro Bueno
Bad url classification
2008-06-24/a>
Jason Lam
SQL Injection mitigation in ASP
2008-06-23/a>
donald smith
Preventing SQL injection
2008-06-18/a>
Chris Carboni
Cisco Security Advisory
2008-06-17/a>
Kyle Haugsness
Why go high-tech?
2008-06-10/a>
Swa Frantzen
Ransomware keybreaking
2008-06-09/a>
Scott Fendley
So Where Are Those OpenSSH Key-based Attacks?
2008-06-02/a>
Jim Clausing
Emergingthreats.net and ThePlanet
2008-06-01/a>
Mark Hofman
Free Yahoo email account! Sign me up, Ok well maybe not.
2008-06-01/a>
Swa Frantzen
The Planet outage - what can we all learn from it?
2008-05-26/a>
Marcus Sachs
Predictable Response
2008-05-22/a>
Chris Carboni
From the mailbag
2008-05-19/a>
Maarten Van Horenbeeck
Text message and telephone aid scams
2008-05-19/a>
Maarten Van Horenbeeck
Route filtering and its impact on the DNS fabric
2008-05-15/a>
Bojan Zdrnja
Debian and Ubuntu users: fix your keys/certificates NOW
2008-05-15/a>
Bojan Zdrnja
INFOCon yellow: update your Debian generated keys/certs ASAP
2008-04-24/a>
Maarten Van Horenbeeck
Targeted attacks using malicious PDF files
2008-04-23/a>
Mari Nichols
What's New, Old and Morphing?
2008-04-16/a>
William Stearns
Passer, a aassive machine and service sniffer
2008-04-14/a>
John Bambenek
A Federal Subpoena or Just Some More Spam & Malware?
2008-04-11/a>
John Bambenek
ADSL Router / Cable Modem / Home Wireless AP Hardening in 5 Steps
2008-04-10/a>
Deborah Hale
Symantec Threatcon Level 2
2008-04-08/a>
Swa Frantzen
Symantec's Global Internet Security Threat Report
2008-04-07/a>
John Bambenek
Network Solutions Technical Difficulties? Enom too
2008-04-06/a>
Tony Carothers
Happenings in the Northeast US
2008-04-04/a>
Daniel Wesemann
Tax day scams
2008-03-30/a>
Mark Hofman
Mail Anyone?
2008-03-27/a>
Maarten Van Horenbeeck
Guarding the guardians: a story of PGP key ring theft
2008-03-25/a>
Raul Siles
New Security Challenge - It Happened One Friday
2008-03-23/a>
Johannes Ullrich
Finding hidden gems (easter eggs) in your logs (packet challenge!)
2008-03-12/a>
Joel Esler
Don't use G-Archiver
2008-03-12/a>
Joel Esler
Adobe security updates
2007-01-03/a>
Toby Kohlenberg
VLC Media Player udp URL handler Format String Vulnerability
2006-12-12/a>
Swa Frantzen
Offline Microsoft Patching
2006-10-05/a>
John Bambenek
There are no more Passive Exploits
2006-10-02/a>
Jim Clausing
Reader's tip of the day: ratios vs. raw counts
2006-09-19/a>
Swa Frantzen
Yet another MSIE 0-day: VML
2006-09-18/a>
Jim Clausing
Log analysis follow up
2006-09-12/a>
Swa Frantzen
Adobe Flash player upgrade time
2006-09-09/a>
Jim Clausing
Log Analysis tips?
2006-09-09/a>
Jim Clausing
New feature at isc.sans.org
2006-09-09/a>
Jim Clausing
A few preliminary log analysis thoughts
2006-08-31/a>
Swa Frantzen
Mailbag grab
Homepage
Diaries
Podcasts
Jobs
Data
TCP/UDP Port Activity
Port Trends
SSH/Telnet Scanning Activity
Weblogs
Threat Feeds Activity
Threat Feeds Map
Useful InfoSec Links
Presentations & Papers
Research Papers
API
Tools
DShield Sensor
DNS Looking Glass
Honeypot (RPi/AWS)
InfoSec Glossary
Forums
Auditing
Diary Discussions
Forensics
General Discussions
Industry News
Network Security
Penetration Testing
Software Security
Contact Us
Contact Us
About Us
Handlers
Slack Channel
Mastodon
Twitter
Follow the Internet Storm Center on
Twitter