Internet Storm Center
Sign In
Sign Up
SANS Network Security: Las Vegas Sept 4-9.
Handler on Duty:
Xavier Mertens
Threat Level:
green
Date
Author
Title
2024-10-17
Guy Bruneau
Scanning Activity from Subnet 15.184.0.0/16
2024-09-25
Guy Bruneau
OSINT - Image Analysis or More Where, When, and Metadata [Guest Diary]
2024-09-18
Guy Bruneau
Time-to-Live Analysis of DShield Data with Vega-Lite
2024-09-11
Guy Bruneau
Hygiene, Hygiene, Hygiene! [Guest Diary]
2024-08-27
Guy Bruneau
Vega-Lite with Kibana to Parse and Display IP Activity over Time
2024-08-16
Jesse La Grew
[Guest Diary] 7 minutes and 4 steps to a quick win: A write-up on custom tools
2024-06-13
Guy Bruneau
The Art of JQ and Command-line Fu [Guest Diary]
2024-05-28
Guy Bruneau
Is that It? Finding the Unknown: Correlations Between Honeypot Logs & PCAPs [Guest Diary]
2024-04-29
Guy Bruneau
Linux Trojan - Xorddos with Filename eyshcjdmzg
2024-03-29
Xavier Mertens
Quick Forensics Analysis of Apache logs
2024-02-25
Guy Bruneau
Utilizing the VirusTotal API to Query Files Uploaded to DShield Honeypot [Guest Diary]
2024-02-03
Guy Bruneau
DShield Sensor Log Collection with Elasticsearch
2023-11-17
Jan Kopriva
Phishing page with trivial anti-analysis features
2023-02-04
Guy Bruneau
Assemblyline as a Malware Analysis Sandbox
2023-01-21
Guy Bruneau
DShield Sensor JSON Log to Elasticsearch
2023-01-08
Guy Bruneau
DShield Sensor JSON Log Analysis
2022-07-29
Johannes Ullrich
PDF Analysis Intro and OpenActions Entries
2022-07-18
Didier Stevens
Adding Your Own Keywords To My PDF Tools
2022-06-01
Jan Kopriva
HTML phishing attachments - now with anti-analysis features
2021-04-10
Guy Bruneau
Building an IDS Sensor with Suricata & Zeek with Logs to ELK
2021-04-06
Jan Kopriva
Malspam with Lokibot vs. Outlook and RFCs
2021-01-30
Guy Bruneau
PacketSifter as Network Parsing and Telemetry Tool
2021-01-14
Bojan Zdrnja
Dynamically analyzing a heavily obfuscated Excel 4 macro malicious file
2020-12-03
Brad Duncan
Traffic Analysis Quiz: Mr Natural
2020-11-11
Brad Duncan
Traffic Analysis Quiz: DESKTOP-FX23IK5
2020-10-01
Daniel Wesemann
Making sense of Azure AD (AAD) activity logs
2020-09-20
Guy Bruneau
Analysis of a Salesforce Phishing Emails
2020-06-01
Jim Clausing
Stackstrings, type 2
2020-05-02
Guy Bruneau
Phishing PDF with Unusual Hostname
2020-01-25
Guy Bruneau
Is Threat Hunting the new Fad?
2020-01-12
Guy Bruneau
ELK Dashboard and Logstash parser for tcp-honeypot Logs
2019-12-29
Guy Bruneau
ELK Dashboard for Pihole Logs
2019-12-07
Guy Bruneau
Integrating Pi-hole Logs in ELK with Logstash
2019-11-23
Guy Bruneau
Local Malware Analysis with Malice
2019-10-18
Xavier Mertens
Quick Malicious VBS Analysis
2019-06-27
Rob VandenBrink
Finding the Gold in a Pile of Pennies - Long Tail Analysis in PowerShell
2019-06-14
Jim Clausing
A few Ghidra tips for IDA users, part 4 - function call graphs
2019-04-17
Jim Clausing
A few Ghidra tips for IDA users, part 2 - strings and parameters
2019-04-08
Jim Clausing
A few Ghidra tips for IDA users, part 1 - the decompiler/unreachable code
2019-04-03
Jim Clausing
A few Ghidra tips for IDA users, part 0 - automatic comments for API call parameters
2019-03-31
Didier Stevens
Maldoc Analysis of the Weekend by a Reader
2019-02-27
Didier Stevens
Maldoc Analysis by a Reader
2018-11-18
Guy Bruneau
Multipurpose PCAP Analysis Tool
2018-10-21
Pasquale Stirparo
Beyond good ol’ LaunchAgent - part 0
2018-08-31
Jim Clausing
Quickie: Using radare2 to disassemble shellcode
2018-06-01
Remco Verhoef
Binary analysis with Radare2
2017-09-29
Lorna Hutcheson
Good Analysis = Understanding(tools + logs + normal)
2017-07-09
Russ McRee
Adversary hunting with SOF-ELK
2017-04-28
Russell Eubanks
KNOW before NO
2017-01-28
Lorna Hutcheson
Packet Analysis - Where do you start?
2016-12-24
Didier Stevens
Pinging All The Way
2016-10-30
Pasquale Stirparo
Volatility Bot: Automated Memory Analysis
2016-10-17
Didier Stevens
Maldoc VBA Anti-Analysis: Video
2016-10-15
Didier Stevens
Maldoc VBA Anti-Analysis
2016-05-14
Guy Bruneau
INetSim as a Basic Honeypot
2016-04-21
Daniel Wesemann
Decoding Pseudo-Darkleech (Part #2)
2015-05-03
Russ McRee
VolDiff, for memory image differential analysis
2014-07-05
Guy Bruneau
Malware Analysis with pedump
2014-04-21
Daniel Wesemann
Finding the bleeders
2014-03-13
Daniel Wesemann
Web server logs containing RS=^ ?
2014-01-14
Chris Mohan
Spamming and scanning botnets - is there something I can do to block them from my site?
2013-10-28
Daniel Wesemann
Exploit cocktail (Struts, Java, Windows) going after 3-month old vulnerabilities
2013-06-18
Russ McRee
Volatility rules...any questions?
2013-05-11
Lenny Zeltser
Extracting Digital Signatures from Signed Malware
2013-03-09
Guy Bruneau
IPv6 Focus Month: IPv6 Encapsulation - Protocol 41
2013-02-03
Lorna Hutcheson
Is it Really an Attack?
2013-01-08
Jim Clausing
Cuckoo 0.5 is out and the world didn't end
2012-12-02
Guy Bruneau
Collecting Logs from Security Devices at Home
2012-09-19
Kevin Liston
Volatility: 2.2 is Coming Soon
2012-09-14
Lenny Zeltser
Analyzing Malicious RTF Files Using OfficeMalScanner's RTFScan
2012-06-21
Russ McRee
Analysis of drive-by attack sample set
2012-06-04
Lenny Zeltser
Decoding Common XOR Obfuscation in Malicious Code
2012-05-23
Mark Baggett
IP Fragmentation Attacks
2012-03-03
Jim Clausing
New automated sandbox for Android malware
2012-02-07
Jim Clausing
Book Review: Practical Packet Analysis, 2nd ed
2011-05-20
Guy Bruneau
Sysinternals Updates, Analyzing Stuxnet Infection with Sysinternals Tools Part 3
2011-04-14
Adrien de Beaupre
Sysinternals updates, a new blog post, and webcast
2011-02-01
Lenny Zeltser
The Importance of HTTP Headers When Investigating Malicious Sites
2010-08-09
Jim Clausing
Free/inexpensive tools for monitoring systems/networks
2010-07-21
Adrien de Beaupre
autorun.inf and .lnk Malware (NOT 'Vulnerability in Windows Shell Could Allow Remote Code Execution' 2286198)
2010-05-26
Bojan Zdrnja
Malware modularization and AV detection evasion
2010-04-11
Marcus Sachs
Network and process forensics toolset
2010-03-26
Daniel Wesemann
Getting the EXE out of the RTF again
2010-02-13
Lorna Hutcheson
Network Traffic Analysis in Reverse
2010-01-14
Bojan Zdrnja
PDF Babushka
2010-01-07
Daniel Wesemann
Static analysis of malicious PDFs
2010-01-07
Daniel Wesemann
Static analysis of malicous PDFs (Part #2)
2009-11-25
Jim Clausing
Updates to my GREM Gold scripts and a new script
2009-11-03
Bojan Zdrnja
Opachki, from (and to) Russia with love
2009-09-25
Lenny Zeltser
Categories of Common Malware Traits
2009-07-26
Jim Clausing
New Volatility plugins
2009-07-02
Daniel Wesemann
Getting the EXE out of the RTF
2009-04-15
Marcus Sachs
2009 Data Breach Investigation Report
2009-03-13
Bojan Zdrnja
When web application security, Microsoft and the AV vendors all fail
2009-02-10
Bojan Zdrnja
More tricks from Conficker and VM detection
2009-02-09
Bojan Zdrnja
Some tricks from Conficker's bag
2009-01-18
Daniel Wesemann
3322. org
2009-01-15
Bojan Zdrnja
Conficker's autorun and social engineering
2009-01-07
Bojan Zdrnja
An Israeli patriot program or a trojan
2009-01-02
Rick Wanner
Tools on my Christmas list.
2008-12-13
Jim Clausing
Followup from last shift and some research to do.
2008-11-17
Marcus Sachs
New Tool: NetWitness Investigator
2008-11-17
Jim Clausing
Finding stealth injected DLLs
2008-09-03
Daniel Wesemann
Static analysis of Shellcode - Part 2
2008-07-07
Pedro Bueno
Bad url classification
2006-10-02
Jim Clausing
Reader's tip of the day: ratios vs. raw counts
2006-09-18
Jim Clausing
Log analysis follow up
2006-09-09
Jim Clausing
Log Analysis tips?
2006-09-09
Jim Clausing
A few preliminary log analysis thoughts
Homepage
Diaries
Podcasts
Jobs
Data
TCP/UDP Port Activity
Port Trends
SSH/Telnet Scanning Activity
Weblogs
Threat Feeds Activity
Threat Feeds Map
Useful InfoSec Links
Presentations & Papers
Research Papers
API
Tools
DShield Sensor
DNS Looking Glass
Honeypot (RPi/AWS)
InfoSec Glossary
Contact Us
Contact Us
About Us
Handlers
About Us
Slack Channel
Mastodon
Bluesky
X
This site is powered by
your submissions
, so tell us
what you see happening