Diaries by Keyword: Log Analysis

DateAuthorTitle

LOG ANALYSIS

2014-03-13Daniel WesemannWeb server logs containing RS=^ ?
2014-01-14Chris MohanSpamming and scanning botnets - is there something I can do to block them from my site?
2012-12-02Guy BruneauCollecting Logs from Security Devices at Home

LOG

2014-04-04Rob VandenBrinkDealing with Disaster - A Short Malware Incident Response
2014-04-01Johannes Ullrichcmd.so Synology Scanner Also Found on Routers
2014-03-31Johannes UllrichMore Device Malware: This is why your DVR attacked my Synology Disk Station (and now with Bitcoin Miner!)
2014-03-28Johannes UllrichWar of the Bots: When DVRs attack NASs
2014-03-26Johannes UllrichLet's Finally "Nail" This Port 5000 Traffic - Synology owners needed.
2014-03-13Daniel WesemannWeb server logs containing RS=^ ?
2014-02-14Chris MohanScanning activity for /siemens/bootstrapping/JnlpBrowser/Development/
2014-02-09Basil Alawi S.TaherMandiant Highlighter 2
2014-01-27Basil Alawi S.TaherLog Parsing with Mandiant Highlighter (1)
2014-01-14Chris MohanSpamming and scanning botnets - is there something I can do to block them from my site?
2014-01-04Tom WebbMonitoring Windows Networks Using Syslog (Part One)
2013-12-03Rob VandenBrinkEven in the Quietest Moments ...
2013-11-16Guy BruneauSagan as a Log Normalizer
2013-10-10Mark HofmanCSAM Some more unusual scans
2013-09-24Tom WebbIDS, NSM, and Log Management with Security Onion 12.04.3
2013-09-11Alex StanfordGetting Started with Rsyslog Filters
2013-09-02Guy BruneauSnort IDS Sensor with Sguil New ISO Released
2013-08-21Alex StanfordPsst. Your Browser Knows All Your Secrets.
2013-02-28Daniel WesemannParsing Windows Eventlogs in Powershell
2013-02-27Adam SwangerGuest Diary: Dylan Johnson - There's value in them there logs!
2013-02-22Chris MohanPHP 5.4.12 and PHP 5.3.22 released http://www.php.net/ChangeLog-5.php
2013-02-17Guy BruneauHP ArcSight Connector Appliance and Logger Vulnerabilities
2013-02-06Johannes UllrichAre you losing system logging information (and don't know it)?
2012-12-02Guy BruneauCollecting Logs from Security Devices at Home
2012-07-13Russ McRee2 for 1: SANSFIRE & MSRA presentations
2012-07-11Rick WannerExcellent Security Education Resources
2012-05-02Bojan ZdrnjaMonitoring VMWare logs
2012-04-08Chris MohanBlog Log: More noise or a rich source of intelligence?
2011-11-19Kevin ListonMonitoring your Log Monitoring Process
2011-06-21Chris MohanAustralian government security audit report shows tough love to agencies
2011-06-20Chris MohanLog files - are you reviewing yours?
2011-05-17Johannes UllrichA Couple Days of Logs: Looking for the Russian Business Network
2011-03-29Daniel WesemannMaking sense of RSA ACE server audit logs
2011-03-11Guy BruneauSnort IDS Sensor with Sguil Framework ISO
2011-01-24Rob VandenBrink
2010-12-24Daniel WesemannA question of class
2010-09-28Daniel WesemannSupporting the economy (in Russia and Ukraine)
2010-07-24Manuel Humberto Santander PelaezTransmiting logon information unsecured in the network
2010-04-06Daniel WesemannApplication Logs
2010-03-10Rob VandenBrinkWhat's My Firewall Telling Me? (Part 4)
2010-03-05Kyle HaugsnessWhat is your firewall log telling you - responses
2010-02-23Mark HofmanWhat is your firewall telling you and what is TCP249?
2010-02-06Guy BruneauOracle WebLogic Server Security Alert
2010-01-29Johannes UllrichAnalyzing isc.sans.org weblogs, part 2, RFI attacks
2010-01-20Johannes UllrichWeathering the Storm Part 1: An analysis of our SANS ISC weblogs http://appsecstreetfighter.com
2009-10-26Johannes UllrichWeb honeypot Update
2009-10-26Johannes UllrichToday: ISC Login bugfix day. If you have issues logging in using OpenID, please email a copy of your OpenID URL to jullrich\at\sans.edu
2009-04-16Adrien de BeaupreStrange Windows Event Log entry
2009-04-09Johannes UllrichConficker update with payload
2009-03-26Mark HofmanWebhoneypot fun
2009-01-09Johannes UllrichSANS Log Management Survey
2008-11-05donald smithIf you missed President Elect Obamas speech have some malware instead
2008-08-19Johannes UllrichA morning stroll through my web logs
2008-08-05Daniel WesemannWatching those DNS logs
2006-10-02Jim ClausingReader's tip of the day: ratios vs. raw counts
2006-09-18Jim ClausingLog analysis follow up
2006-09-09Jim ClausingLog Analysis tips?
2006-09-09Jim ClausingA few preliminary log analysis thoughts

ANALYSIS

2014-03-13Daniel WesemannWeb server logs containing RS=^ ?
2014-01-14Chris MohanSpamming and scanning botnets - is there something I can do to block them from my site?
2013-10-28Daniel WesemannExploit cocktail (Struts, Java, Windows) going after 3-month old vulnerabilities
2013-06-18Russ McReeVolatility rules...any questions?
2013-05-11Lenny ZeltserExtracting Digital Signatures from Signed Malware
2013-03-09Guy BruneauIPv6 Focus Month: IPv6 Encapsulation - Protocol 41
2013-02-03Lorna HutchesonIs it Really an Attack?
2013-01-08Jim ClausingCuckoo 0.5 is out and the world didn't end
2012-12-02Guy BruneauCollecting Logs from Security Devices at Home
2012-09-19Kevin ListonVolatility: 2.2 is Coming Soon
2012-09-14Lenny ZeltserAnalyzing Malicious RTF Files Using OfficeMalScanner's RTFScan
2012-06-21Russ McReeAnalysis of drive-by attack sample set
2012-06-04Lenny ZeltserDecoding Common XOR Obfuscation in Malicious Code
2012-05-23Mark BaggettIP Fragmentation Attacks
2012-03-03Jim ClausingNew automated sandbox for Android malware
2012-02-07Jim ClausingBook Review: Practical Packet Analysis, 2nd ed
2011-05-20Guy BruneauSysinternals Updates, Analyzing Stuxnet Infection with Sysinternals Tools Part 3
2011-04-14Adrien de BeaupreSysinternals updates, a new blog post, and webcast
2011-02-01Lenny ZeltserThe Importance of HTTP Headers When Investigating Malicious Sites
2010-08-09Jim ClausingFree/inexpensive tools for monitoring systems/networks
2010-07-21Adrien de Beaupreautorun.inf and .lnk Malware (NOT 'Vulnerability in Windows Shell Could Allow Remote Code Execution' 2286198)
2010-05-26Bojan ZdrnjaMalware modularization and AV detection evasion
2010-04-11Marcus SachsNetwork and process forensics toolset
2010-03-26Daniel WesemannGetting the EXE out of the RTF again
2010-02-13Lorna HutchesonNetwork Traffic Analysis in Reverse
2010-01-14Bojan ZdrnjaPDF Babushka
2010-01-07Daniel WesemannStatic analysis of malicious PDFs
2010-01-07Daniel WesemannStatic analysis of malicous PDFs (Part #2)
2009-11-25Jim ClausingUpdates to my GREM Gold scripts and a new script
2009-11-03Bojan ZdrnjaOpachki, from (and to) Russia with love
2009-09-25Lenny ZeltserCategories of Common Malware Traits
2009-07-26Jim ClausingNew Volatility plugins
2009-07-02Daniel WesemannGetting the EXE out of the RTF
2009-04-15Marcus Sachs2009 Data Breach Investigation Report
2009-03-13Bojan ZdrnjaWhen web application security, Microsoft and the AV vendors all fail
2009-02-10Bojan ZdrnjaMore tricks from Conficker and VM detection
2009-02-09Bojan ZdrnjaSome tricks from Conficker's bag
2009-01-18Daniel Wesemann3322. org
2009-01-15Bojan ZdrnjaConficker's autorun and social engineering
2009-01-07Bojan ZdrnjaAn Israeli patriot program or a trojan
2009-01-02Rick WannerTools on my Christmas list.
2008-12-13Jim ClausingFollowup from last shift and some research to do.
2008-11-17Marcus SachsNew Tool: NetWitness Investigator
2008-11-17Jim ClausingFinding stealth injected DLLs
2008-09-03Daniel WesemannStatic analysis of Shellcode - Part 2
2008-07-07Pedro BuenoBad url classification
2006-10-02Jim ClausingReader's tip of the day: ratios vs. raw counts
2006-09-18Jim ClausingLog analysis follow up
2006-09-09Jim ClausingLog Analysis tips?
2006-09-09Jim ClausingA few preliminary log analysis thoughts