Date Author Title

COMMAND AND CONTROL CHANNEL

2016-07-26Johannes UllrichCommand and Control Channels Using "AAAA" DNS Records

COMMAND

2025-05-30/a>Jesse La GrewUsage of "passwd" Command in DShield Honeypots
2024-07-10/a>Jesse La GrewFinding Honeypot Data Clusters Using DBSCAN: Part 1
2024-04-29/a>Johannes UllrichD-Link NAS Device Backdoor Abused
2023-06-11/a>Guy BruneauDShield Honeypot Activity for May 2023
2021-02-13/a>Guy BruneauvSphere Replication updates address a command injection vulnerability (CVE-2021-21976) - https://www.vmware.com/security/advisories/VMSA-2021-0001.html
2021-02-05/a>Xavier MertensVBA Macro Trying to Alter the Application Menus
2020-02-14/a>Xavier MertensKeep an Eye on Command-Line Browsers
2019-07-16/a>Russ McReeCommando VM: The Complete Mandiant Offensive VM
2018-07-30/a>Xavier MertensExploiting the Power of Curl
2018-05-02/a>Russ McReeWindows Commands Reference - An InfoSec Must Have
2016-07-26/a>Johannes UllrichCommand and Control Channels Using "AAAA" DNS Records
2016-04-15/a>Xavier MertensWindows Command Line Persistence?
2015-10-12/a>Guy BruneauCritical Vulnerability in Multiple Cisco Products - Apache Struts 2 Command Execution http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20131023-struts2
2013-02-17/a>Guy BruneauHP ArcSight Connector Appliance and Logger Vulnerabilities
2010-02-06/a>Guy BruneauLANDesk Management Gateway Vulnerability
2010-01-27/a>Raul SilesCommand Line Kung Fu

AND

2025-05-30/a>Jesse La GrewUsage of "passwd" Command in DShield Honeypots
2024-12-17/a>Guy BruneauCommand Injection Exploit For PHPUnit before 4.8.28 and 5.x before 5.6.3 [Guest Diary]
2024-08-23/a>Jesse La GrewPandas Errors: What encoding are my logs in?
2024-07-16/a>Guy BruneauWho You Gonna Call? AndroxGh0st Busters! [Guest Diary]
2024-07-10/a>Jesse La GrewFinding Honeypot Data Clusters Using DBSCAN: Part 1
2024-04-29/a>Johannes UllrichD-Link NAS Device Backdoor Abused
2024-02-20/a>Xavier MertensPython InfoStealer With Dynamic Sandbox Detection
2023-10-31/a>Xavier MertensMultiple Layers of Anti-Sandboxing Techniques
2023-07-01/a>Russ McReeSandfly Security
2023-06-11/a>Guy BruneauDShield Honeypot Activity for May 2023
2023-05-24/a>Tom WebbIR Case/Alert Management
2023-03-12/a>Guy BruneauAsynRAT Trojan - Bill Payment (Pago de la factura)
2022-09-26/a>Xavier MertensEasy Python Sandbox Detection
2022-08-22/a>Xavier Mertens32 or 64 bits Malware?
2022-06-03/a>Xavier MertensSandbox Evasion... With Just a Filename!
2021-12-06/a>Xavier MertensThe Importance of Out-of-Band Networks
2021-04-02/a>Xavier MertensC2 Activity: Sandboxes or Real Victims?
2021-02-13/a>Guy BruneauvSphere Replication updates address a command injection vulnerability (CVE-2021-21976) - https://www.vmware.com/security/advisories/VMSA-2021-0001.html
2021-02-05/a>Xavier MertensVBA Macro Trying to Alter the Application Menus
2020-09-16/a>Johannes UllrichDo Vulnerabilities Ever Get Old? Recent "Mirai" Variant Scanning for 20 Year Old Amanda Version?
2020-09-03/a>Xavier MertensSandbox Evasion Using NTP
2020-04-16/a>Johannes UllrichUsing AppLocker to Prevent Living off the Land Attacks
2020-02-14/a>Xavier MertensKeep an Eye on Command-Line Browsers
2020-02-07/a>Xavier MertensSandbox Detection Tricks & Nice Obfuscation in a Single VBScript
2019-07-16/a>Russ McReeCommando VM: The Complete Mandiant Offensive VM
2019-01-10/a>Brad DuncanHeartbreaking Emails: "Love You" Malspam
2018-08-01/a>Johannes UllrichWhen Cameras and Routers attack Phones. Spike in CVE-2014-8361 Exploits Against Port 52869
2018-07-30/a>Xavier MertensExploiting the Power of Curl
2018-07-24/a>Brad DuncanRecent Emotet activity
2018-05-02/a>Russ McReeWindows Commands Reference - An InfoSec Must Have
2017-01-06/a>John BambenekGreat Misadventures of Security Vendors: Absurd Sandboxing Edition
2017-01-05/a>John BambenekNew Year's Resolution: Build Your Own Malware Lab?
2016-12-10/a>Didier StevensSleeping VBS Really Wants To Sleep
2016-07-26/a>Johannes UllrichCommand and Control Channels Using "AAAA" DNS Records
2016-06-22/a>Bojan ZdrnjaSecurity through obscurity never works
2016-05-02/a>Rick WannerFake Chrome update for Android
2016-04-15/a>Xavier MertensWindows Command Line Persistence?
2015-12-16/a>Xavier MertensPlaying With Sandboxes Like a Boss
2015-12-05/a>Guy BruneauAre you looking to setup your own Malware Sandbox?
2015-12-04/a>Tom WebbAutomating Phishing Analysis using BRO
2015-10-12/a>Guy BruneauCritical Vulnerability in Multiple Cisco Products - Apache Struts 2 Command Execution http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20131023-struts2
2015-07-28/a>Rick WannerAndroid Stagefright multimedia viewer prone to remote exploitation
2015-04-27/a>Richard PorterWhen Prevention Fails, Incident Response Begins
2014-09-12/a>Chris MohanAre credential dumps worth reviewing?
2014-08-12/a>Adrien de BeaupreHost discovery with nmap
2014-08-04/a>Russ McReeThreats & Indicators: A Security Intelligence Lifecycle
2014-05-01/a>Johannes UllrichMicrosoft Announces Special Patch for IE 0-day (Win XP included!)
2014-04-26/a>Guy BruneauAndroid Users - Beware of Bitcoin Mining Malware
2014-04-05/a>Jim ClausingThose strange e-mails with URLs in them can lead to Android malware
2014-04-01/a>Basil Alawi S.TaherUpgrading Your Android, Elevating My Malware
2014-03-11/a>Basil Alawi S.TaherIntroduction to Memory Analysis with Mandiant Redline
2014-02-10/a>Rob VandenBrinkIsn't it About Time to Get Moving on Chip and PIN?
2014-02-07/a>Rob VandenBrinkNew ISO Standards on Vulnerability Handling and Disclosure
2014-01-23/a>Chris MohanLearning from the breaches that happens to others Part 2
2013-12-05/a>Mark HofmanUpdated Standards Part 1 - ISO 27001
2013-09-23/a>Rob VandenBrinkHow do you spell "PSK"?
2013-02-22/a>Chris MohanPHP 5.4.12 and PHP 5.3.22 released http://www.php.net/ChangeLog-5.php
2013-02-17/a>Guy BruneauHP ArcSight Connector Appliance and Logger Vulnerabilities
2013-01-30/a>Richard PorterGetting Involved with the Local Community
2013-01-14/a>Richard PorterJanuary 2013 Microsoft Out of Cycle Patch
2013-01-08/a>Jim ClausingCuckoo 0.5 is out and the world didn't end
2012-12-13/a>Johannes UllrichWhat if Tomorrow Was the Day?
2012-10-24/a>Russ McReeCyber Security Awareness Month - Day 24 - A Standard for Information Security Incident Management - ISO 27035
2012-10-23/a>Rob VandenBrinkCyber Security Awareness Month - Day 23: Character Encoding Standards - ASCII and Successors
2012-10-17/a>Rob VandenBrinkCyber Security Awareness Month - Day 17 - A Standard for Risk Management - ISO 27005
2012-10-12/a>Mark HofmanCyber Security Awareness Month - Day 12 PCI DSS
2012-10-11/a>Rob VandenBrinkCyber Security Awareness Month - Day 11 - Vendor Agnostic Standards (Center for Internet Security)
2012-10-09/a>Johannes UllrichCyber Security Awreness Month - Day 9 - Request for Comment (RFC)
2012-05-18/a>Johannes UllrichZTE Score M Android Phone backdoor
2012-04-23/a>Russ McReeEmergency Operations Centers & Security Incident Management: A Correlation
2012-03-03/a>Jim ClausingNew automated sandbox for Android malware
2011-11-03/a>Richard PorterAn Apple, Inc. Sandbox to play in.
2011-11-01/a>Russ McReeHoneynet Project: Android Reverse Engineering (A.R.E.) Virtual Machine released
2011-10-29/a>Richard PorterThe Sub Critical Control? Evidence Collection
2011-09-15/a>Johannes UllrichSSH Vandals?
2011-09-07/a>Lenny ZeltserAnalyzing Mobile Device Malware - Honeynet Forensic Challenge 9 and Some Tools
2011-05-18/a>Bojan ZdrnjaAndroid, HTTP and authentication tokens
2011-03-22/a>Chris MohanRead only USB stick trick
2011-03-03/a>Manuel Humberto Santander PelaezRogue apps inside Android Marketplace
2011-01-08/a>Guy BruneauPandaLabs 2010 Annual Report
2010-12-31/a>Bojan ZdrnjaAndroid malware enters 2011
2010-11-19/a>Jason LamAdobe Reader X - Sandbox
2010-10-19/a>Rob VandenBrinkCyber Security Awareness Month - Day 19 - VPN and Remote Access Tools
2010-08-04/a>Tom ListonIncident Reporting - Liston's "How-To" Guide
2010-07-25/a>Rick WannerUpdated version of Mandiant's Web Historian
2010-07-21/a>Adrien de BeaupreAdobe Reader Protected Mode
2010-02-07/a>Rick WannerMandiant Mtrends Report
2010-02-06/a>Guy BruneauLANDesk Management Gateway Vulnerability
2010-01-27/a>Raul SilesCommand Line Kung Fu
2010-01-21/a>Chris Carboni* Microsoft Out Of Band Patch Release
2010-01-11/a>Johannes UllrichFake Android Application
2009-07-24/a>Rick WannerMicrosoft Out of Band Patch
2009-06-11/a>Rick WannerWHO Declares Flu A(H1N1) a Pandemic
2009-05-19/a>Rick WannerNew Version of Mandiant Highlighter
2009-05-01/a>Adrien de BeaupreIncident Management
2009-04-26/a>Johannes UllrichPandemic Preparation - Swine Flu
2009-04-16/a>Adrien de BeaupreIncident Response vs. Incident Handling
2009-04-07/a>Johannes UllrichCommon Apache Misconception
2009-02-05/a>Rick WannerMandiant Memoryze review, Hilighter, other Mandiant tools!
2008-11-25/a>Andre LudwigTmobile G1 handsets having DNS problems?
2008-10-29/a>Deborah HaleDay 29 - Should I Switch Software Vendors?
2008-10-23/a>Mark HofmanMicrosoft out-of-band patch - Severity Critical
2008-09-09/a>Swa Frantzenwordpress upgrade
2008-08-09/a>Deborah HaleCleveland Outage

CONTROL

2024-04-22/a>Jan KoprivaIt appears that the number of industrial devices accessible from the internet has risen by 30 thousand over the past three years
2022-05-03/a>Rob VandenBrinkFinding the Real "Last Patched" Day (Interim Version)
2021-07-08/a>Xavier MertensUsing Sudo with Python For More Security Controls
2021-05-12/a>Jan KoprivaNumber of industrial control systems on the internet is lower then in 2020...but still far from zero
2019-10-19/a>Russell EubanksWhat Assumptions Are You Making?
2019-07-25/a>Rob VandenBrinkWhen Users Attack! Users (and Admins) Thwarting Security Controls
2019-07-18/a>Rob VandenBrinkThe Other Side of Critical Control 1: 802.1x Wired Network Access Controls
2017-07-24/a>Russell EubanksTrends Over Time
2017-06-10/a>Russell EubanksAn Occasional Look in the Rear View Mirror
2016-11-23/a>Tom WebbMapping Attack Methodology to Controls
2016-10-08/a>Russell EubanksUnauthorized Change Detected!
2016-07-26/a>Johannes UllrichCommand and Control Channels Using "AAAA" DNS Records
2015-12-21/a>Daniel WesemannCritical Security Controls: Getting to know the unknown
2015-11-04/a>Richard PorterApplication Aware and Critical Control 2
2015-05-29/a>Russell EubanksTrust But Verify
2014-10-13/a>Lorna HutchesonFor or Against: Port Security for Network Access Control
2014-08-17/a>Rick WannerPart 2: Is your home network unwittingly contributing to NTP DDOS attacks?
2014-07-28/a>Guy BruneauManagement and Control of Mobile Device Security
2014-06-11/a>Daniel WesemannHelp your pilot fly!
2014-02-10/a>Rob VandenBrinkA Tale of Two Admins (and no Change Control)
2013-09-02/a>Guy BruneauMultiple Cisco Security Notice
2013-03-13/a>Mark BaggettWipe the drive! Stealthy Malware Persistence Mechanism - Part 1
2012-12-31/a>Manuel Humberto Santander PelaezHow to determine which NAC solutions fits best to your needs
2012-11-23/a>Rob VandenBrinkWhat's in Your Change Control Form?
2011-11-03/a>Richard PorterAn Apple, Inc. Sandbox to play in.
2011-10-29/a>Richard PorterThe Sub Critical Control? Evidence Collection
2011-10-28/a>Daniel WesemannCritical Control 20: Security Skills Assessment and Training to fill Gaps
2011-10-27/a>Mark BaggettCritical Control 18: Incident Response Capabilities
2011-10-26/a>Rick WannerCritical Control 17:Penetration Tests and Red Team Exercises
2011-10-17/a>Rob VandenBrinkCritical Control 11: Account Monitoring and Control
2010-08-22/a>Rick WannerFailure of controls...Spanair crash caused by a Trojan
2010-08-19/a>Rob VandenBrinkChange is Good. Change is Bad. Change is Life.
2010-08-05/a>Rob VandenBrinkAccess Controls for Network Infrastructure
2010-06-14/a>Manuel Humberto Santander PelaezPython on a microcontroller?
2010-06-07/a>Manuel Humberto Santander PelaezSoftware Restriction Policy to keep malware away
2009-10-22/a>Adrien de BeaupreCyber Security Awareness Month - Day 22 port 502 TCP - Modbus

CHANNEL

2016-07-26/a>Johannes UllrichCommand and Control Channels Using "AAAA" DNS Records
2013-08-21/a>Rob VandenBrinkFibre Channel Reconnaissance - Reloaded