Internet Storm Center
Sign In
Sign Up
SANS Network Security: Las Vegas Sept 4-9.
Handler on Duty:
Didier Stevens
Threat Level:
green
Date
Author
Title
2024-09-25
Johannes Ullrich
DNS Reflection Update and Odd Corrupted DNS Requests
2024-09-13
Jesse La Grew
Finding Honeypot Data Clusters Using DBSCAN: Part 2
2024-08-30
Jesse La Grew
Simulating Traffic With Scapy
2024-08-29
Xavier Mertens
Live Patching DLLs with Python
2024-08-26
Xavier Mertens
From Highly Obfuscated Batch File to XWorm and Redline
2024-08-22
Johannes Ullrich
OpenAI Scans for Honeypots. Artificially Malicious? Action Abuse?
2024-07-16
Guy Bruneau
Who You Gonna Call? AndroxGh0st Busters! [Guest Diary]
2024-07-10
Jesse La Grew
Finding Honeypot Data Clusters Using DBSCAN: Part 1
2024-07-08
Xavier Mertens
Kunai: Keep an Eye on your Linux Hosts Activity
2024-06-20
Guy Bruneau
No Excuses, Free Tools to Help Secure Authentication in Ubuntu Linux [Guest Diary]
2024-06-17
Xavier Mertens
New NetSupport Campaign Delivered Through MSIX Packages
2024-06-13
Guy Bruneau
The Art of JQ and Command-line Fu [Guest Diary]
2024-05-06
Johannes Ullrich
Detecting XFinity/Comcast DNS Spoofing
2024-04-22
Jan Kopriva
It appears that the number of industrial devices accessible from the internet has risen by 30 thousand over the past three years
2024-03-28
Xavier Mertens
From JavaScript to AsyncRAT
2024-03-17
Guy Bruneau
Gamified Learning: Using Capture the Flag Challenges to Supplement Cybersecurity Training [Guest Diary]
2024-03-13
Xavier Mertens
Using ChatGPT to Deobfuscate Malicious Scripts
2024-03-10
Guy Bruneau
What happens when you accidentally leak your AWS API keys? [Guest Diary]
2024-03-06
Bojan Zdrnja
Scanning and abusing the QUIC protocol
2024-03-03
Guy Bruneau
Capturing DShield Packets with a LAN Tap [Guest Diary]
2024-02-20
Xavier Mertens
Python InfoStealer With Dynamic Sandbox Detection
2024-02-09
Xavier Mertens
MSIX With Heavily Obfuscated PowerShell Script
2024-02-03
Guy Bruneau
DShield Sensor Log Collection with Elasticsearch
2024-01-26
Xavier Mertens
A Batch File With Multiple Payloads
2024-01-24
Johannes Ullrich
How Bad User Interfaces Make Security Tools Harmful
2024-01-12
Xavier Mertens
One File, Two Payloads
2024-01-02
Johannes Ullrich
Fingerprinting SSH Identification Strings
2023-12-16
Xavier Mertens
An Example of RocketMQ Exploit Scanner
2023-12-06
Jan Kopriva
Whose packet is it anyway: a new RFC for attribution of internet probes
2023-11-08
Xavier Mertens
Example of Phishing Campaign Project File
2023-09-30
Xavier Mertens
Simple Netcat Backdoor in Python Script
2023-09-23
Guy Bruneau
Scanning for Laravel - a PHP Framework for Web Artisants
2023-09-07
Johannes Ullrich
Fleezeware/Scareware Advertised via Facebook Tags; Available in Apple App Store
2023-08-28
Johannes Ullrich
Home Office / Small Business Hurricane Prep
2023-08-20
Guy Bruneau
SystemBC Malware Activity
2023-08-16
Yee Ching Tok
A Gentle Reminder: The Evolving Nature of Digital Scams
2023-07-06
Jesse La Grew
IDS Comparisons with DShield Honeypot Data
2023-06-16
Xavier Mertens
Another RAT Delivered Through VBS
2023-06-09
Xavier Mertens
Undetected PowerShell Backdoor Disguised as a Profile File
2023-05-26
Xavier Mertens
Using DFIR Techniques To Recover From Infrastructure Outages
2023-05-22
Johannes Ullrich
Probes for recent ABUS Security Camera Vulnerability: Attackers keep an eye on everything.
2023-05-17
Xavier Mertens
Increase in Malicious RAR SFX files
2023-05-14
Guy Bruneau
VMware Aria Operations addresses multiple Local Privilege Escalations and a Deserialization issue
2023-05-03
Xavier Mertens
Increased Number of Configuration File Scans
2023-04-28
Xavier Mertens
Quick IOC Scan With Docker
2023-04-07
Xavier Mertens
Detecting Suspicious API Usage with YARA Rules
2023-03-30
Xavier Mertens
Bypassing PowerShell Strong Obfuscation
2023-03-28
Jesse La Grew
Network Data Collector Placement Makes a Difference
2023-03-21
Didier Stevens
String Obfuscation: Character Pair Reversal
2023-03-18
Xavier Mertens
Old Backdoor, New Obfuscation
2023-02-12
Jesse La Grew
PCAP Data Analysis with Zeek
2023-02-10
Xavier Mertens
Obfuscated Deactivation of Script Block Logging
2023-02-04
Guy Bruneau
Assemblyline as a Malware Analysis Sandbox
2023-02-01
Didier Stevens
Detecting (Malicious) OneNote Files
2023-01-25
Xavier Mertens
A First Malicious OneNote Document
2023-01-15
Johannes Ullrich
Elon Musk Themed Crypto Scams Flooding YouTube Today
2023-01-02
Xavier Mertens
NetworkMiner 2.8 Released
2022-12-29
Jesse La Grew
Opening the Door for a Knock: Creating a Custom DShield Listener
2022-11-28
Johannes Ullrich
Ukraine Themed Twitter Spam Pushing iOS Scareware
2022-11-19
Guy Bruneau
McAfee Fake Antivirus Phishing Campaign is Back!
2022-11-14
Jesse La Grew
Extracting 'HTTP CONNECT' Requests with Python
2022-11-05
Guy Bruneau
Windows Malware with VHD Extension
2022-11-04
Xavier Mertens
Remcos Downloader with Unicode Obfuscation
2022-11-02
Brad Duncan
Who put the "Dark" in DarkVNC?
2022-10-31
Rob VandenBrink
NMAP without NMAP - Port Testing and Scanning with PowerShell
2022-10-19
Xavier Mertens
Are Internet Scanning Services Good or Bad for You?
2022-10-18
Xavier Mertens
Python Obfuscation for Dummies
2022-09-21
Xavier Mertens
Phishing Campaigns Use Free Online Resources
2022-08-26
Xavier Mertens
Paypal Phishing/Coinbase in One Image
2022-08-26
Guy Bruneau
HTTP/2 Packet Analysis with Wireshark
2022-08-22
Xavier Mertens
32 or 64 bits Malware?
2022-07-23
Guy Bruneau
Analysis of SSH Honeypot Data with PowerBI
2022-07-20
Johannes Ullrich
Apple Patches Everything Day
2022-07-06
Johannes Ullrich
How Many SANs are Insane?
2022-06-24
Xavier Mertens
Python (ab)using The Windows GUI
2022-06-19
Didier Stevens
Video: Decoding Obfuscated BASE64 Statistically
2022-06-18
Didier Stevens
Decoding Obfuscated BASE64 Statistically
2022-06-16
Xavier Mertens
Houdini is Back Delivered Through a JavaScript Dropper
2022-06-01
Jan Kopriva
HTML phishing attachments - now with anti-analysis features
2022-05-09
Xavier Mertens
Octopus Backdoor is Back with a New Embedded Obfuscated Bat File
2022-05-07
Guy Bruneau
Phishing PDF Received in my ISC Mailbox
2022-03-29
Johannes Ullrich
More Fake/Typosquatting Twitter Accounts Asking for Ukraine Crytocurrency Donations
2022-03-20
Didier Stevens
MGLNDD_* Scans
2022-03-07
Johannes Ullrich
No Bitcoin - No Problem: Follow Up to Last Weeks Donation Scam
2022-03-04
Johannes Ullrich
Scam E-Mail Impersonating Red Cross
2022-02-15
Xavier Mertens
Who Are Those Bots?
2022-02-13
Guy Bruneau
DHL Spear Phishing to Capture Username/Password
2022-02-01
Xavier Mertens
Automation is Nice But Don't Replace Your Knowledge
2022-01-16
Guy Bruneau
10 Most Popular Targeted Ports in the Past 3 Weeks
2022-01-03
Xavier Mertens
McAfee Phishing Campaign with a Nice Fake Scan
2021-12-22
Brad Duncan
December 2021 Forensic Contest: Answers and Analysis
2021-12-08
Brad Duncan
December 2021 Forensic Challenge
2021-11-26
Guy Bruneau
Searching for Exposed ASUS Routers Vulnerable to CVE-2021-20090
2021-11-20
Guy Bruneau
Hikvision Security Cameras Potentially Exposed to Remote Code Execution
2021-11-18
Xavier Mertens
JavaScript Downloader Delivers Agent Tesla Trojan
2021-11-14
Didier Stevens
Video: Obfuscated Maldoc: Reversed BASE64
2021-11-08
Xavier Mertens
(Ab)Using Security Tools & Controls for the Bad
2021-11-04
Brad Duncan
October 2021 Forensic Contest: Answers and Analysis
2021-10-30
Guy Bruneau
Remote Desktop Protocol (RDP) Discovery
2021-10-22
Brad Duncan
October 2021 Contest: Forensic Challenge
2021-10-18
Xavier Mertens
Malicious PowerShell Using Client Certificate Authentication
2021-10-09
Guy Bruneau
Scanning for Previous Oracle WebLogic Vulnerabilities
2021-09-22
Didier Stevens
An XML-Obfuscated Office Document (CVE-2021-40444)
2021-09-17
Xavier Mertens
Malicious Calendar Subscriptions Are Back?
2021-09-07
Johannes Ullrich
Why I Gave Up on IPv6. And no, it is not because of security issues.
2021-09-02
Xavier Mertens
Attackers Will Always Abuse Major Events in our Lifes
2021-08-13
Guy Bruneau
Scanning for Microsoft Exchange eDiscovery
2021-07-31
Guy Bruneau
Unsolicited DNS Queries
2021-07-10
Guy Bruneau
Scanning for Microsoft Secure Socket Tunneling Protocol
2021-06-30
Brad Duncan
June 2021 Forensic Contest: Answers and Analysis
2021-06-26
Guy Bruneau
CVE-2019-9670: Zimbra Collaboration Suite XXE vulnerability
2021-06-24
Xavier Mertens
Do you Like Cookies? Some are for sale!
2021-06-23
Johannes Ullrich
Standing With Security Researchers Against Misuse of the DMCA
2021-06-17
Daniel Wesemann
Network Forensics on Azure VMs (Part #1)
2021-06-12
Guy Bruneau
Fortinet Targeted for Unpatched SSL VPN Discovery Activity
2021-06-04
Xavier Mertens
Russian Dolls VBS Obfuscation
2021-05-31
Rick Wanner
Quick and dirty Python: nmap
2021-05-29
Guy Bruneau
Spear-phishing Email Targeting Outlook Mail Clients
2021-05-23
Didier Stevens
Video: Making Sense Of Encrypted Cobalt Strike Traffic
2021-05-19
Brad Duncan
May 2021 Forensic Contest: Answers and Analysis
2021-05-12
Jan Kopriva
Number of industrial control systems on the internet is lower then in 2020...but still far from zero
2021-05-08
Guy Bruneau
Who is Probing the Internet for Research Purposes?
2021-05-05
Brad Duncan
May 2021 Forensic Contest
2021-05-04
Rick Wanner
Quick and dirty Python: masscan
2021-04-26
Didier Stevens
CAD: .DGN and .MVBA Files
2021-04-24
Guy Bruneau
Base64 Hashes Used in Web Scanning
2021-04-18
Didier Stevens
Decoding Cobalt Strike Traffic
2021-04-12
Didier Stevens
Example of Cleartext Cobalt Strike Traffic (Thanks Brad)
2021-04-10
Guy Bruneau
Building an IDS Sensor with Suricata & Zeek with Logs to ELK
2021-04-01
Brad Duncan
April 2021 Forensic Quiz
2021-03-17
Xavier Mertens
Defenders, Know Your Operating System Like Attackers Do!
2021-03-07
Didier Stevens
PCAPs and Beacons
2021-02-26
Guy Bruneau
Pretending to be an Outlook Version Update
2021-02-13
Guy Bruneau
Using Logstash to Parse IPtables Firewall Logs
2021-01-30
Guy Bruneau
PacketSifter as Network Parsing and Telemetry Tool
2021-01-11
Rob VandenBrink
Using the NVD Database and API to Keep Up with Vulnerabilities and Patches - Tool Drop: CVEScan (Part 3 of 3)
2021-01-05
Johannes Ullrich
Netfox Detective: An Alternative Open-Source Packet Analysis Tool
2021-01-04
Jan Kopriva
From a small BAT file to Mass Logger infostealer
2020-12-22
Xavier Mertens
Malware Victim Selection Through WiFi Identification
2020-12-17
Daniel Wesemann
"Amazon" invoice that asks to call 1-866-335-0659 "to cancel" an order that you never made is (obviously) a #scam
2020-12-06
Didier Stevens
oledump's Indicators (video)
2020-12-05
Guy Bruneau
Is IP 91.199.118.137 testing Access to aahwwx.52host.xyz?
2020-12-04
Guy Bruneau
Detecting Actors Activity with Threat Intel
2020-12-03
Brad Duncan
Traffic Analysis Quiz: Mr Natural
2020-11-19
Xavier Mertens
PowerShell Dropper Delivering Formbook
2020-11-13
Xavier Mertens
Old Worm But New Obfuscation Technique
2020-11-11
Brad Duncan
Traffic Analysis Quiz: DESKTOP-FX23IK5
2020-11-05
Xavier Mertens
Did You Spot "Invoke-Expression"?
2020-10-30
Xavier Mertens
Quick Status of the CAA DNS Record Adoption
2020-10-25
Didier Stevens
Video: Pascal Strings
2020-10-24
Guy Bruneau
An Alternative to Shodan, Censys with User-Agent CensysInspect/1.1
2020-10-20
Xavier Mertens
Mirai-alike Python Scanner
2020-10-14
Xavier Mertens
Nicely Obfuscated Python RAT
2020-10-03
Guy Bruneau
Scanning for SOHO Routers
2020-09-20
Guy Bruneau
Analysis of a Salesforce Phishing Emails
2020-09-15
Brad Duncan
Traffic Analysis Quiz: Oh No... Another Infection!
2020-09-04
Jan Kopriva
A blast from the past - XXEncoded VB6.0 Trojan
2020-08-22
Guy Bruneau
Remote Desktop (TCP/3389) and Telnet (TCP/23), What might they have in Common?
2020-08-19
Xavier Mertens
Example of Word Document Delivering Qakbot
2020-08-16
Didier Stevens
Small Challenge: A Simple Word Maldoc - Part 3
2020-08-08
Guy Bruneau
Scanning Activity Include Netcat Listener
2020-08-05
Brad Duncan
Traffic Analysis Quiz: What's the Malware From This Infection?
2020-07-24
Xavier Mertens
Compromized Desktop Applications by Web Technologies
2020-07-19
Guy Bruneau
Scanning Activity for ZeroShell Unauthenticated Access
2020-07-15
Brad Duncan
Word docs with macros for IcedID (Bokbot)
2020-07-11
Guy Bruneau
VMware XPC Client validation privilege escalation vulnerability - https://www.vmware.com/security/advisories/VMSA-2020-0017.html
2020-07-11
Guy Bruneau
Scanning Home Internet Facing Devices to Exploit
2020-07-08
Xavier Mertens
If You Want Something Done Right, You Have To Do It Yourself... Malware Too!
2020-06-16
Johannes Ullrich
Odd "Protest" Spam (Scam?) Targeting Atlanta Police Foundation
2020-06-13
Guy Bruneau
Mirai Botnet Activity
2020-06-08
Didier Stevens
Translating BASE64 Obfuscated Scripts
2020-05-31
Guy Bruneau
Windows 10 Built-in Packet Sniffer - PktMon
2020-05-28
Xavier Mertens
Flashback on CVE-2019-19781
2020-05-20
Brad Duncan
Microsoft Word document with malicious macro pushes IcedID (Bokbot)
2020-05-16
Guy Bruneau
Scanning for Outlook Web Access (OWA) & Microsoft Exchange Control Panel (ECP)
2020-05-08
Xavier Mertens
Using Nmap As a Lightweight Vulnerability Scanner
2020-04-27
Xavier Mertens
Powershell Payload Stored in a PSCredential Object
2020-04-24
Xavier Mertens
Malicious Excel With a Strong Obfuscation and Sandbox Evasion
2020-04-10
Xavier Mertens
PowerShell Sample Extracting Payload From SSL
2020-04-08
Brad Duncan
German malspam pushes ZLoader malware
2020-04-07
Johannes Ullrich
Increase in RDP Scanning
2020-04-03
Xavier Mertens
Obfuscated with a Simple 0x0A
2020-04-01
Brad Duncan
Qakbot malspam sent from an infected Windows host
2020-03-31
Johannes Ullrich
Kwampirs Targeted Attacks Involving Healthcare Sector
2020-03-21
Guy Bruneau
Honeypot - Scanning and Targeting Devices & Services
2020-03-11
Xavier Mertens
Agent Tesla Delivered via Fake Canon EOS Notification on Free OwnCloud Account
2020-02-29
Guy Bruneau
Hazelcast IMDG Discover Scan
2020-02-25
Jan Kopriva
Quick look at a couple of current online scam campaigns
2020-02-22
Xavier Mertens
Simple but Efficient VBScript Obfuscation
2020-02-07
Xavier Mertens
Sandbox Detection Tricks & Nice Obfuscation in a Single VBScript
2020-01-23
Xavier Mertens
Complex Obfuscation VS Simple Trick
2020-01-15
Johannes Ullrich
CVE-2020-0601 Followup
2020-01-13
Didier Stevens
Citrix ADC Exploits: Overview of Observed Payloads
2020-01-11
Johannes Ullrich
Citrix ADC Exploits are Public and Heavily Used. Attempts to Install Backdoor
2020-01-07
Johannes Ullrich
A Quick Update on Scanning for CVE-2019-19781 (Citrix ADC / Gateway Vulnerability)
2020-01-05
Didier Stevens
etl2pcapng: Convert .etl Capture Files To .pcapng Format
2019-12-31
Johannes Ullrich
Some Thoughts About the Critical Citrix ADC/Gateway Vulnerability (CVE-2019-19781)
2019-12-24
Brad Duncan
Malspam with links to Word docs pushes IcedID (Bokbot)
2019-12-22
Didier Stevens
Extracting VBA Macros From .DWG Files
2019-12-16
Didier Stevens
Malicious .DWG Files?
2019-12-03
Brad Duncan
Ursnif infection with Dridex
2019-11-27
Brad Duncan
Finding an Agent Tesla malware sample
2019-11-23
Guy Bruneau
Local Malware Analysis with Malice
2019-11-22
Xavier Mertens
Abusing Web Filters Misconfiguration for Reconnaissance
2019-11-18
Johannes Ullrich
SMS and 2FA: Another Reason to Move away from It.
2019-11-09
Guy Bruneau
Fake Netflix Update Request by Text
2019-11-05
Rick Wanner
Bluekeep exploitation causing Bluekeep vulnerability scan to fail
2019-11-03
Didier Stevens
You Too? "Unusual Activity with Double Base64 Encoding"
2019-10-30
Xavier Mertens
Keep an Eye on Remote Access to Mailboxes
2019-10-29
Xavier Mertens
Generating PCAP Files from YAML
2019-10-20
Guy Bruneau
Scanning Activity for NVMS-9000 Digital Video Recorder
2019-10-19
Russell Eubanks
What Assumptions Are You Making?
2019-10-18
Xavier Mertens
Quick Malicious VBS Analysis
2019-10-09
Brad Duncan
What data does Vidar malware steal from an infected host?
2019-10-03
Jim Clausing
Buffer overflows found in libpcap and tcpdump
2019-09-27
Xavier Mertens
New Scans for Polycom Autoconfiguration Files
2019-09-07
Guy Bruneau
Unidentified Scanning Activity
2019-08-09
Xavier Mertens
100% JavaScript Phishing Page
2019-08-05
Rick Wanner
Scanning for Bluekeep vulnerable RDP instances
2019-08-01
Johannes Ullrich
What is Listening On Port 9527/TCP?
2019-07-25
Rob VandenBrink
When Users Attack! Users (and Admins) Thwarting Security Controls
2019-07-18
Rob VandenBrink
The Other Side of Critical Control 1: 802.1x Wired Network Access Controls
2019-07-11
Xavier Mertens
Russian Dolls Malicious Script Delivering Ursnif
2019-07-02
Xavier Mertens
Malicious Script With Multiple Payloads
2019-06-20
Xavier Mertens
Using a Travel Packing App for Infosec Purpose
2019-06-10
Xavier Mertens
Interesting JavaScript Obfuscation Example
2019-05-31
Didier Stevens
Retrieving Second Stage Payload with Ncat
2019-05-22
Johannes Ullrich
An Update on the Microsoft Windows RDP "Bluekeep" Vulnerability (CVE-2019-0708) [now with pcaps]
2019-05-16
Xavier Mertens
The Risk of Authenticated Vulnerability Scans
2019-04-11
Johannes Ullrich
How to Find Hidden Cameras in your AirBNB
2019-04-04
Xavier Mertens
New Waves of Scans Detected by an Old Rule
2019-03-18
Didier Stevens
Wireshark 3.0.0 and Npcap: Some Remarks
2019-03-11
Didier Stevens
Wireshark 3.0.0 and Npcap
2019-03-09
Guy Bruneau
A Comparison Study of SSH Port Activity - TCP 22 & 2222
2019-03-08
Remco Verhoef
Analysing meterpreter payload with Ghidra
2019-02-18
Didier Stevens
Know What You Are Logging
2019-02-02
Guy Bruneau
Scanning for WebDAV PROPFIND Exploiting CVE-2017-7269
2019-01-12
Guy Bruneau
Snorpy a Web Base Tool to Build Snort/Suricata Rules
2019-01-02
Lorna Hutcheson
Gift Card Scams on the rise
2018-12-31
Didier Stevens
Software Crashes: A New Year's Resolution
2018-12-29
Didier Stevens
Video: De-DOSfuscation Example
2018-12-23
Guy Bruneau
Scanning Activity, end Goal is to add Hosts to Mirai Botnet
2018-12-16
Guy Bruneau
Random Port Scan for Open RDP Backdoor
2018-12-15
Didier Stevens
De-DOSfuscation Example
2018-12-12
Didier Stevens
Yet Another DOSfuscation Sample
2018-12-09
Johannes Ullrich
Arrest of Huawei CFO Inspires Advance Fee Scam
2018-11-27
Xavier Mertens
More obfuscated shell scripts: Fake MacOS Flash update
2018-11-26
Xavier Mertens
Obfuscated bash script targeting QNap boxes
2018-11-18
Guy Bruneau
Multipurpose PCAP Analysis Tool
2018-11-16
Xavier Mertens
Basic Obfuscation With Permissive Languages
2018-11-14
Brad Duncan
Day in the life of a researcher: Finding a wave of Trickbot malspam
2018-11-06
Xavier Mertens
Malicious Powershell Script Dissection
2018-10-23
Xavier Mertens
Diving into Malicious AutoIT Code
2018-10-08
Guy Bruneau
Latest Release of rockNSM 2.1
2018-09-30
Didier Stevens
When DOSfuscation Helps...
2018-09-19
Rob VandenBrink
Certificates Revisited - SSL VPN Certificates 2 Ways
2018-09-18
Rob VandenBrink
Using Certificate Transparency as an Attack / Defense Tool
2018-09-05
Rob VandenBrink
Where have all my Certificates gone? (And when do they expire?)
2018-09-04
Rob VandenBrink
Let's Trade: You Read My Email, I'll Read Your Password!
2018-08-15
Xavier Mertens
Truncating Payloads and Anonymizing PCAP files
2018-07-30
Didier Stevens
Malicious Word documents using DOSfuscation
2018-07-26
Xavier Mertens
Windows Batch File Deobfuscation
2018-07-03
Didier Stevens
Progress indication for scripts on Windows
2018-07-02
Guy Bruneau
Hello Peppa! - PHP Scans
2018-06-18
Xavier Mertens
Malicious JavaScript Targeting Mobile Browsers
2018-06-06
Xavier Mertens
Converting PCAP Web Traffic to Apache Log
2018-05-25
Xavier Mertens
Antivirus Evasion? Easy as 1,2,3
2018-05-06
Guy Bruneau
Scans Attempting to use PowerShell to Download PHP Script
2018-04-30
Remco Verhoef
Another approach to webapplication fingerprinting
2018-03-11
Guy Bruneau
rockNSM Configuration & Installation Steps http://handlers.sans.org/gbruneau/rockNSM%20as%20an%20Incident%20Response%20Package.htm
2018-03-08
Xavier Mertens
CRIMEB4NK IRC Bot
2018-02-28
Kevin Liston
How did this Memcache thing happen?
2018-01-23
John Bambenek
Life after GDPR: Implications for Cybersecurity
2018-01-18
Xavier Mertens
Comment your Packet Captures!
2018-01-07
Guy Bruneau
SSH Scans by Clients Types
2017-12-18
Didier Stevens
Phish or scam? - Part 2
2017-12-17
Didier Stevens
Phish or scam? - Part 1
2017-11-23
Xavier Mertens
Proactive Malicious Domain Search
2017-11-13
Guy Bruneau
jsonrpc Scanning for root account
2017-11-11
Xavier Mertens
Keep An Eye on your Root Certificates
2017-11-03
Xavier Mertens
Simple Analysis of an Obfuscated JAR File
2017-10-27
Renato Marinho
"Catch-All" Google Chrome Malicious Extension Steals All Posted Data
2017-10-06
Johannes Ullrich
What's in a cable? The dangers of unauthorized cables
2017-10-05
Johannes Ullrich
pcap2curl: Turning a pcap file into a set of cURL commands for "replay"
2017-09-30
Lorna Hutcheson
Who's Borrowing your Resources?
2017-09-28
Xavier Mertens
The easy way to analyze huge amounts of PCAP data
2017-09-17
Guy Bruneau
rockNSM as a Incident Response Package
2017-08-24
Bojan Zdrnja
Free Bitcoins? Why not?
2017-07-30
Guy Bruneau
Text Banking Scams
2017-07-24
Renato Marinho
Uber drivers new threat: the "passenger"
2017-07-24
Russell Eubanks
Trends Over Time
2017-07-19
Xavier Mertens
Bots Searching for Keys & Config Files
2017-07-08
Xavier Mertens
A VBScript with Obfuscated Base64 Data
2017-06-22
Xavier Mertens
Obfuscating without XOR
2017-06-17
Guy Bruneau
Mapping Use Cases to Logs. Which Logs are the Most Important to Collect?
2017-06-15
Bojan Zdrnja
Uberscammers
2017-06-10
Russell Eubanks
An Occasional Look in the Rear View Mirror
2017-06-01
Xavier Mertens
Sharing Private Data with Webcast Invitations
2017-05-28
Pasquale Stirparo
Analysis of Competing Hypotheses (ACH part 1)
2017-05-26
Lorna Hutcheson
File2pcap - A new tool for your toolkit!
2017-05-18
Xavier Mertens
My Little CVE Bot
2017-05-02
Richard Porter
Do you have Intel AMT? Then you have a problem today! Intel Active Management Technology INTEL-SA-00075
2017-04-28
Xavier Mertens
Another Day, Another Obfuscation Technique
2017-04-22
Jim Clausing
WTF tcp port 81
2017-04-21
Xavier Mertens
Analysis of a Maldoc with Multiple Layers of Obfuscation
2017-04-19
Xavier Mertens
Hunting for Malicious Excel Sheets
2017-04-13
Rob VandenBrink
Packet Captures Filtered by Process
2017-03-30
Xavier Mertens
Diverting built-in features for the bad
2017-03-25
Russell Eubanks
Distraction as a Service
2017-03-24
Xavier Mertens
Nicely Obfuscated JavaScript Sample
2017-03-18
Xavier Mertens
Example of Multiple Stages Dropper
2017-03-10
Xavier Mertens
The Side Effect of GeoIP Filters
2017-02-28
Xavier Mertens
Analysis of a Simple PHP Backdoor
2017-02-12
Xavier Mertens
Analysis of a Suspicious Piece of JavaScript
2017-01-28
Lorna Hutcheson
Packet Analysis - Where do you start?
2017-01-26
Xavier Mertens
IOC's: Risks of False Positive Alerts Flood Ahead
2017-01-14
Xavier Mertens
Backup Files Are Good but Can Be Evil
2017-01-13
Xavier Mertens
Who's Attacking Me?
2016-12-31
Xavier Mertens
Ongoing Scans Below the Radar
2016-11-27
Russ McRee
Scapy vs. CozyDuke
2016-11-11
Rick Wanner
Benevolent malware? reincarna/Linux.Wifatch
2016-11-05
Xavier Mertens
Full Packet Capture for Dummies
2016-11-02
Rob VandenBrink
What Does a Pentest Look Like?
2016-10-25
Xavier Mertens
Another Day, Another Spam...
2016-10-19
Xavier Mertens
Spam Delivered via .ICS Files
2016-10-07
Rick Wanner
First Hurricane Matthew related Phish
2016-09-15
Xavier Mertens
In Need of a OTP Manager Soon?
2016-09-10
Xavier Mertens
Ongoing IMAP Scan, Anyone Else?
2016-08-29
Russ McRee
Recommended Reading: Intrusion Detection Using Indicators of Compromise Based on Best Practices and Windows Event Logs
2016-08-28
Guy Bruneau
Spam with Obfuscated Javascript
2016-08-22
Russ McRee
Red Team Tools Updates: hashcat and SpiderFoot
2016-08-19
Xavier Mertens
Data Classification For the Masses
2016-08-01
Daniel Wesemann
Are you getting I-CANNED ?
2016-07-08
Mark Hofman
Malware being distributed pretending to be from AU Fedcourts
2016-06-29
Xavier Mertens
Phishing Campaign with Blurred Images
2016-06-22
Bojan Zdrnja
Security through obscurity never works
2016-06-03
Tom Liston
MySQL is YourSQL
2016-05-26
Xavier Mertens
Keeping an Eye on Tor Traffic
2016-05-08
Jim Clausing
Guest Diary: Linux Capabilities - A friend and foe
2016-02-20
Didier Stevens
Locky: JavaScript Deobfuscation
2016-02-11
Tom Webb
Tomcat IR with XOR.DDoS
2016-02-07
Xavier Mertens
More Malicious JavaScript Obfuscation
2016-02-03
Xavier Mertens
Automating Vulnerability Scans
2016-02-02
Johannes Ullrich
Targeted IPv6 Scans Using pool.ntp.org .
2016-01-29
Xavier Mertens
Scripting Web Categorization
2016-01-25
Rob VandenBrink
Assessing Remote Certificates with Powershell
2016-01-15
Xavier Mertens
JavaScript Deobfuscation Tool
2015-12-21
Daniel Wesemann
Critical Security Controls: Getting to know the unknown
2015-11-04
Richard Porter
Application Aware and Critical Control 2
2015-11-04
Johannes Ullrich
Internet Wide Scanners Wanted
2015-09-08
Lenny Zeltser
A Close Look at PayPal Overpayment Scams That Target Craigslist Sellers
2015-08-28
Didier Stevens
Test File: PDF With Embedded DOC Dropping EICAR
2015-06-28
Didier Stevens
The EICAR Test File
2015-05-29
Russell Eubanks
Trust But Verify
2015-04-28
Daniel Wesemann
Scammy Nepal earthquake donation requests
2015-04-23
Bojan Zdrnja
When automation does not help
2015-04-08
Tom Webb
Is it a breach or not?
2015-03-26
Daniel Wesemann
Pin-up on your Smartphone!
2015-02-27
Rick Wanner
Let's Encrypt!
2015-02-17
Rob VandenBrink
oclHashcat 1.33 Released
2014-11-24
Richard Porter
Someone is using this? PoS: Compressor
2014-11-04
Daniel Wesemann
20$ is 999999 Euro
2014-10-06
Johannes Ullrich
CSAM: Patch and get pw0ned (not OR).
2014-09-19
Guy Bruneau
Added today in oclhashcat 131 Django [Default Auth] (PBKDF2 SHA256 Rounds Salt) Support - http://hashcat.net/hashcat/
2014-09-19
Guy Bruneau
Web Scan looking for /info/whitelist.pac
2014-09-16
Daniel Wesemann
https://yourfakebank.support -- TLD confusion starts!
2014-09-10
Johannes Ullrich
Content Security Policy (CSP) is Growing Up.
2014-08-27
Rob VandenBrink
One More Day of Trolling in POS Memory
2014-08-25
Jim Clausing
Unusual CRL traffic?
2014-08-09
Adrien de Beaupre
Complete application ownage via Multi-POST XSRF
2014-07-30
Rick Wanner
Symantec Endpoint Protection Privilege Escalation Zero Day
2014-07-26
Chris Mohan
"Internet scanning project" scans
2014-07-06
Richard Porter
Physical Access, Point of Sale, Vegas
2014-07-03
Johannes Ullrich
Credit Card Processing in 700 Words or Less
2014-06-28
Mark Hofman
No more Microsoft advisory email notifications?
2014-06-22
Russ McRee
OfficeMalScanner helps identify the source of a compromise
2014-06-17
Rob VandenBrink
Canada's Anti-Spam Legislation (CASL) 2014
2014-06-13
Richard Porter
A welcomed response, PF Chang's
2014-06-11
Daniel Wesemann
Gimme your keys!
2014-06-04
Richard Porter
p0f, Got Packets?
2014-06-01
Johannes Ullrich
When was the last time you checked your Comcast cable modem settings?
2014-05-22
Johannes Ullrich
Discontinuing Support for ISC Alert Task Bar Icon
2014-04-17
Manuel Humberto Santander Pelaez
Looking for malicious traffic in electrical SCADA networks - part 2 - solving problems with DNP3 Secure Authentication Version 5
2014-04-15
Manuel Humberto Santander Pelaez
Looking for malicious traffic in electrical SCADA networks - part 1
2014-04-12
Guy Bruneau
Critical Security Update for JetPack WordPress Plugin. Bug has existed since Jetpack 1.9, released in October 2012. - http://jetpack.me/2014/04/10/jetpack-security-update/
2014-03-24
Johannes Ullrich
Integrating Physical Security Sensors
2014-03-13
Daniel Wesemann
Identification and authentication are hard ... finding out intention is even harder
2014-03-06
Mark Baggett
Port 5000 traffic and snort signature
2014-02-26
Russ McRee
Ongoing NTP Amplification Attacks
2014-02-15
Rob VandenBrink
More on HNAP - What is it, How to Use it, How to Find it
2014-02-14
Chris Mohan
Scanning activity for /siemens/bootstrapping/JnlpBrowser/Development/
2014-02-13
Johannes Ullrich
Linksys Worm ("TheMoon") Captured
2014-02-12
Johannes Ullrich
Suspected Mass Exploit Against Linksys E1000 / E1200 Routers
2014-01-31
Chris Mohan
Looking for packets from three particular subnets
2014-01-30
Johannes Ullrich
New gTLDs appearing in the root zone
2014-01-17
Russ McRee
Massive RFI scans likely a free web app vuln scanner rather than bots
2014-01-13
Johannes Ullrich
Special Webcast today: HTML5, Risky Business or Hidden Security Toolchest? https://www.sans.org/webcasts/html5-risky-business-hidden-security-tool-chest-mobile-web-app-authentication-97650
2014-01-11
Guy Bruneau
tcpflow 1.4.4 and some of its most Interesting Features
2014-01-09
Bojan Zdrnja
Massive PHP RFI scans
2014-01-08
Kevin Shortt
Intercepted Email Attempts to Steal Payments
2013-12-28
Russ McRee
Weekend Reading List 27 DEC
2013-12-24
Daniel Wesemann
Mr Jones wants you to appear in court!
2013-12-23
Daniel Wesemann
Costco, BestBuy, Walmart really want to send you a package!
2013-12-21
Daniel Wesemann
Adobe phishing underway
2013-12-20
Daniel Wesemann
authorized key lime pie
2013-12-19
Rob VandenBrink
Passive Scanning Two Ways - How-Tos for the Holidays
2013-12-19
Rob VandenBrink
Target US - Credit Card Data Breach
2013-12-10
Rob VandenBrink
Those Look Just Like Hashes!
2013-12-09
Rob VandenBrink
Scanning without Scanning
2013-12-01
Richard Porter
BPF, PCAP, Binary, hex, why they matter?
2013-11-15
Johannes Ullrich
The Security Impact of HTTP Caching Headers
2013-11-04
Manuel Humberto Santander Pelaez
When attackers use your DNS to check for the sites you are visiting
2013-10-22
Richard Porter
Greenbone and OpenVAS Scanner
2013-10-21
Johannes Ullrich
New tricks that may bring DNS spoofing back or: "Why you should enable DNSSEC even if it is a pain to do"
2013-10-17
Adrien de Beaupre
Internet wide DNS scanning
2013-10-12
Richard Porter
Reported Spike in tcp/5901 and tcp/5900
2013-10-05
Richard Porter
Adobe Breach Notification, Notifications?
2013-10-02
John Bambenek
Obamacare related domain registration spike, Government shutdown domain registration beginning
2013-09-18
Rob VandenBrink
Cisco DCNM Update Released
2013-09-05
Rob VandenBrink
What's Next for IPS?
2013-09-05
Rob VandenBrink
Building Your Own GPU Enabled Private Cloud
2013-09-03
Rob VandenBrink
Is "Reputation Backscatter" a Thing?
2013-08-26
Alex Stanford
Stop, Drop and File Carve
2013-08-19
Rob VandenBrink
ZMAP 1.02 released
2013-08-13
Swa Frantzen
Microsoft security advisories: RDP and MD5 deprecation in Microsoft root certificates
2013-08-02
Johannes Ullrich
Fake American Express Alerts
2013-07-27
Scott Fendley
Defending Against Web Server Denial of Service Attacks
2013-07-13
Lenny Zeltser
Decoy Personas for Safeguarding Online Identity Using Deception
2013-07-01
Manuel Humberto Santander Pelaez
Using nmap scripts to enhance vulnerability asessment results
2013-06-27
Tony Carothers
Physical Security in the Cyber World
2013-06-05
Richard Porter
Wireshark 1.10.0 Stable Released http://www.wireshark.org/download.html
2013-05-22
Adrien de Beaupre
Privilege escalation, why should I care?
2013-05-21
Adrien de Beaupre
Moore, Oklahoma tornado charitable organization scams, malware, and phishing
2013-05-17
Johannes Ullrich
SSL: Another reason not to ignore IPv6
2013-05-11
Lenny Zeltser
Extracting Digital Signatures from Signed Malware
2013-04-29
Adam Swanger
Report Fake Tech Support Calls submission form reminder
2013-04-17
John Bambenek
UPDATEDx1: Boston-Related Malware Campaigns Have Begun - Now with Waco Plant Explosion Fun
2013-04-15
Rob VandenBrink
Oops - You Mean That Deleted Server was a Certificate Authority?
2013-04-10
Manuel Humberto Santander Pelaez
Massive Google scam sent by email to Colombian domains
2013-04-04
Johannes Ullrich
Microsoft April Patch Tuesday Advance Notification
2013-03-29
Chris Mohan
Does your breach email notification look like a phish?
2013-03-23
Guy Bruneau
Apple ID Two-step Verification Now Available in some Countries
2013-03-19
Johannes Ullrich
IPv6 Focus Month: The warm and fuzzy side of IPv6
2013-03-06
Adam Swanger
IPv6 Focus Month: Guest Diary: Stephen Groat - Geolocation Using IPv6 Addresses
2013-03-03
Richard Porter
Uptick in MSSQL Activity
2013-02-20
Manuel Humberto Santander Pelaez
SANS SCADA Summit at Orlando - Bigger problems and so far from getting them solved
2013-02-19
Johannes Ullrich
EDUCAUSE Breach
2013-02-14
Adam Swanger
ISC Monthly Threat Update - February 2013 http://isc.sans.edu/podcastdetail.html?id=3121
2013-02-08
Kevin Shortt
Is it Spam or Is it Malware?
2013-02-06
Johannes Ullrich
Intel Network Card (82574L) Packet of Death
2013-02-03
Lorna Hutcheson
Is it Really an Attack?
2013-01-25
Johannes Ullrich
Vulnerability Scans via Search Engines (Request for Logs)
2013-01-18
Russ McRee
Interesting reads for Friday 18 JAN 2013
2013-01-10
Adam Swanger
ISC Monthly Threat Update New Format
2013-01-07
Adam Swanger
Please consider participating in our 2013 ISC StormCast survey at http://www.surveymonkey.com/s/stormcast
2013-01-03
Manuel Humberto Santander Pelaez
New year and new CA compromised
2012-12-18
Dan Goldberg
Mitigating the impact of organizational change: a risk assessment
2012-12-06
Daniel Wesemann
Fake tech support calls - revisited
2012-12-06
Daniel Wesemann
Rich Quick Make Money!
2012-12-03
John Bambenek
John McAfee Exposes His Location in Photo About His Being on Run
2012-11-30
Daniel Wesemann
Nmap 6.25 released - lots of new goodies, see http://nmap.org/changelog.html
2012-10-26
Adam Swanger
Securing the Human Special Webcast - October 30, 2012
2012-10-10
Kevin Shortt
Facebook Scam Spam
2012-10-06
Manuel Humberto Santander Pelaez
Cyber Security Awareness Month - Day 6 - NERC: The standard that enforces security on power SCADA
2012-10-03
Kevin Shortt
Fake Support Calls Reported
2012-09-13
Mark Baggett
TCP Fuzzing with Scapy
2012-09-05
Rob VandenBrink
Auditing a Network for VOIP Call Quality Metrics
2012-08-21
Adrien de Beaupre
YYABCAFU - Yes Yet Another Bleeping Critical Adobe Flash Update
2012-08-13
Rick Wanner
Interesting scan for medical certification information...
2012-07-18
Rob VandenBrink
Vote NO to Weak Keys!
2012-07-14
Tony Carothers
User Awareness and Education
2012-07-05
Adrien de Beaupre
Microsoft advanced notification for July 2012 patch Tuesday
2012-06-27
Daniel Wesemann
What's up with port 79 ?
2012-06-25
Guy Bruneau
Using JSDetox to Analyze and Deobfuscate Javascript
2012-06-20
Raul Siles
CVE-2012-0217 (from MS12-042) applies to other environments too
2012-06-13
Johannes Ullrich
ICANN "Reveal Day" Lists new TLD Applications
2012-06-13
Johannes Ullrich
Microsoft Certificate Updater
2012-06-04
Johannes Ullrich
Microsoft Emergency Bulletin: Unauthorized Certificate used in "Flame"
2012-05-31
Johannes Ullrich
SCADA@Home: Your health is no secret no more!
2012-05-22
Johannes Ullrich
nmap 6 released
2012-04-26
Richard Porter
Define Irony: A medical device with a Virus?
2012-04-21
Guy Bruneau
WordPress Release Security Update
2012-04-16
Mark Baggett
McAfee DAT troubles
2012-03-30
Daniel Wesemann
Fake tech reps calling
2012-03-13
Lenny Zeltser
Please transfer this email to your CEO or appropriate person, thanks
2012-02-08
Jim Clausing
Chrome to stop checking Certificate Revocation List (CRL)?
2012-01-31
Russ McRee
OSINT tactics: parsing from FOCA for Maltego
2012-01-25
Bojan Zdrnja
pcAnywhere users – patch now!
2012-01-03
Bojan Zdrnja
The tale of obfuscated JavaScript continues
2011-12-12
Daniel Wesemann
You won 100$ or a free iPad!
2011-12-08
Adrien de Beaupre
Microsoft Security Bulletin Advance Notification for December 2011
2011-12-06
Kevin Shortt
Cain & Abel v4.9.43 Released - http://www.oxid.it/
2011-11-23
Johannes Ullrich
SCADA hacks published on Pastebin
2011-11-16
Adrien de Beaupre
GET BACK TO ME ASAP
2011-11-11
Rick Wanner
APPLE-SA-2011-11-10-2 Time Capsule and AirPort Base Station (802.11n) Firmware 7.6 update
2011-11-03
Richard Porter
An Apple, Inc. Sandbox to play in.
2011-11-01
Russ McRee
Secure languages & frameworks
2011-10-29
Richard Porter
The Sub Critical Control? Evidence Collection
2011-10-28
Daniel Wesemann
Critical Control 20: Security Skills Assessment and Training to fill Gaps
2011-10-27
Mark Baggett
Critical Control 18: Incident Response Capabilities
2011-10-26
Rick Wanner
Critical Control 17:Penetration Tests and Red Team Exercises
2011-10-23
Guy Bruneau
tcpdump and IPv6
2011-10-19
Pedro Bueno
The old new Stuxnet...DuQu?
2011-10-19
Johannes Ullrich
House for rent! Observing an Overpayment Scam
2011-10-17
Rob VandenBrink
Critical Control 11: Account Monitoring and Control
2011-10-12
Adam Swanger
We are experiencing technical issues with the webcast. The webcast will start as soon as these issues are resolved.
2011-09-28
Richard Porter
All Along the ARP Tower!
2011-09-19
Guy Bruneau
MS Security Advisory Update - Fraudulent DigiNotar Certificates
2011-09-09
Guy Bruneau
Apple Certificate Trust Policy Update
2011-09-09
Guy Bruneau
Adobe Publish its List of Trusted Root Certificate - http://www.adobe.com/security/approved-trust-list.html
2011-09-08
Rob VandenBrink
When Good CA's go Bad: Other Things to Check in Your Datacenter
2011-08-26
Johannes Ullrich
SANS Virginia Beach Conference Canceled. Details: http://www.sans.org/virginia-beach-2011/
2011-08-26
Johannes Ullrich
Some Hurricane Technology Tips
2011-08-16
Johannes Ullrich
What are the most dangerous web applications and how to secure them?
2011-08-15
Rob VandenBrink
8 Years since the Eastern Seaboard Blackout - Has it Been that Long?
2011-08-14
Guy Bruneau
FireCAT 2.0 Released
2011-07-29
Richard Porter
Apple Lion talking on TCP 5223
2011-07-28
Johannes Ullrich
Announcing: The "404 Project"
2011-07-17
Mark Hofman
SSH Brute Force
2011-07-05
Raul Siles
Helping Developers Understand Security - Spot the Vuln
2011-06-21
Chris Mohan
StartSSL, a web authentication authority, suspend services after a security breach
2011-05-23
Mark Hofman
Microsoft Support Scam (again)
2011-05-18
Bojan Zdrnja
Android, HTTP and authentication tokens
2011-05-12
Johannes Ullrich
ActiveX Flaw Affecting SCADA systems
2011-05-10
Swa Frantzen
Changing MO in scamming our users ?
2011-04-28
Chris Mohan
DSL Reports advise 9,000 accounts were compromised
2011-04-22
Manuel Humberto Santander Pelaez
In-house developed applications: The constant headache for the information security officer
2011-04-03
Richard Porter
Extreme Disclosure? Not yet but a great trend!
2011-03-27
Guy Bruneau
Strange Shockwave File with Surprising Attachments
2011-02-28
Deborah Hale
Possible Botnet Scanning
2011-02-07
Pedro Bueno
The Good , the Bad and the Unknown Online Scanners
2011-02-04
Daniel Wesemann
Oh, just click "yes"
2011-01-10
Manuel Humberto Santander Pelaez
Facebook virus spreads via photo album chat messages
2010-12-27
Johannes Ullrich
Various sites "Owned and Exposed"
2010-12-25
Manuel Humberto Santander Pelaez
An interesting vulnerability playground to learn application vulnerabilities
2010-12-23
Mark Hofman
Older AV Scam Active again.
2010-12-21
Rob VandenBrink
Network Reliability, Part 2 - HSRP Attacks and Defenses
2010-12-13
Deborah Hale
The Week to Top All Weeks
2010-12-12
Raul Siles
New trend regarding web application vulnerabilities?
2010-12-08
Rob VandenBrink
Interesting DDOS activity around Wikileaks
2010-12-01
Deborah Hale
McAfee Security Bulletin Released
2010-12-01
Deborah Hale
A Gentle Reminder - It is that time of year again
2010-11-24
Bojan Zdrnja
Privilege escalation 0-day in almost all Windows versions
2010-11-24
Jim Clausing
Help with odd port scans
2010-10-11
Adrien de Beaupre
OT: Happy Thanksgiving Day Canada
2010-10-03
Adrien de Beaupre
Canada's Cyber Security Strategy released today
2010-09-21
Johannes Ullrich
Implementing two Factor Authentication on the Cheap
2010-08-22
Manuel Humberto Santander Pelaez
SCADA: A big challenge for information security professionals
2010-08-16
Raul Siles
Blind Elephant: A New Web Application Fingerprinting Tool
2010-08-15
Manuel Humberto Santander Pelaez
Obfuscated SQL Injection attacks
2010-08-15
Manuel Humberto Santander Pelaez
Python to test web application security
2010-08-10
Daniel Wesemann
SSH - new brute force tool?
2010-07-13
Jim Clausing
VMware Studio Security Update
2010-07-04
Manuel Humberto Santander Pelaez
New Winpcap Version
2010-07-02
Johannes Ullrich
OISF released version 1.0.0 of Suricata, the open source IDS/IPS engine http://www.openinfosecfoundation.org
2010-06-26
Guy Bruneau
socat to Simulate a Website
2010-06-21
Adrien de Beaupre
GoDaddy Scam/Phish/Spam
2010-06-18
Johannes Ullrich
Please take a second and rate the daily podcast (Stormcast): http://www.surveymonkey.com/s/stormcast
2010-06-15
Manuel Humberto Santander Pelaez
Mastercard delivering cards with OTP device included
2010-06-14
Manuel Humberto Santander Pelaez
Another way to get protection for application-level attacks
2010-06-14
Manuel Humberto Santander Pelaez
Small lot of Olympus Stylus Tough 6010 shipped with malware
2010-06-14
Manuel Humberto Santander Pelaez
Rogue facebook application acting like a worm
2010-06-06
Manuel Humberto Santander Pelaez
Nice OS X exploit tutorial
2010-05-29
G. N. White
Rogue AV Indictment
2010-05-23
Manuel Humberto Santander Pelaez
e-mail scam announcing Fidel Castro's funeral ... and nasty malware to your computer.
2010-05-15
Deborah Hale
Phony Phone Scam
2010-04-22
Deborah Hale
How McAfee turned a Disaster Exercise Into a REAL Learning Experience for Our Community Disaster Team
2010-04-21
Guy Bruneau
McAfee DAT 5958 Update Issues
2010-04-13
Adrien de Beaupre
Web App Testing Tools
2010-04-08
Bojan Zdrnja
JavaScript obfuscation in PDF: Sky is the limit
2010-04-06
Daniel Wesemann
Application Logs
2010-04-02
Guy Bruneau
Oracle Java SE and Java for Business Critical Patch Update Advisory
2010-03-27
Guy Bruneau
Create a Summary of IP Addresses from PCAP Files using Unix Tools
2010-03-21
Scott Fendley
Skipfish - Web Application Security Tool
2010-03-17
Deborah Hale
Trojan outbreak on a College Campus
2010-03-10
Rob VandenBrink
Microsoft re-release of KB973811 - attacks on Extended Protection for Authentication
2010-03-08
Raul Siles
Samurai WTF 0.8
2010-03-05
Kyle Haugsness
Javascript obfuscators used in the wild
2010-03-01
Mark Hofman
AS/NZ "Online Offensive - Fight fraud online" week March 1-7
2010-02-20
Mari Nichols
Is "Green IT" Defeating Security?
2010-02-10
Johannes Ullrich
Twitpic, EXIF and GPS: I Know Where You Did it Last Summer
2010-02-02
Johannes Ullrich
New IPv6 Screencast Videos: http://isc.sans.org/ipv6videos (Today: blocking and detecting IPv6 in Linux)
2010-02-01
Rob VandenBrink
NMAP 5.21 - Is UDP Protocol Specific Scanning Important? Why Should I Care?
2010-01-29
Adrien de Beaupre
Neo-legacy applications
2010-01-24
Pedro Bueno
Outdated client applications
2010-01-09
G. N. White
What's Up With All The Port Scanning Using TCP/6000 As A Source Port?
2009-12-19
Deborah Hale
Educationing Our Communities
2009-12-16
Rob VandenBrink
Beware the Attack of the Christmas Greeting Cards !
2009-12-14
Adrien de Beaupre
Anti-forensics, COFEE vs. DECAF
2009-12-07
Rob VandenBrink
Layer 2 Network Protections – reloaded!
2009-11-25
Jim Clausing
Updates to my GREM Gold scripts and a new script
2009-11-24
John Bambenek
BIND Security Advisory (DNSSEC only)
2009-11-18
Rob VandenBrink
Using a Cisco Router as a “Remote Collector” for tcpdump or Wireshark
2009-11-13
Deborah Hale
It's Never Too Early To Start Teaching Them
2009-11-03
Andre Ludwig
SURBL now posting abuse statistics for TLD's
2009-11-02
Daniel Wesemann
IDN ccTLDs
2009-10-30
Rob VandenBrink
ICANN Strategic Planning (2010-2013) Consultation
2009-10-22
Adrien de Beaupre
Cyber Security Awareness Month - Day 22 port 502 TCP - Modbus
2009-10-20
Raul Siles
WASC 2008 Statistics
2009-10-19
Daniel Wesemann
Scam Email
2009-10-09
Rob VandenBrink
THAWTE to discontinue free Email Certificate Services and Web of Trust Service
2009-09-22
Jason Lam
ESTA scam
2009-09-16
Raul Siles
Review the security controls of your Web Applications... all them!
2009-09-10
Johannes Ullrich
Healthcare Spam
2009-09-05
Mark Hofman
Critical Infrastructure and dependencies
2009-08-28
Adrien de Beaupre
WPA with TKIP done
2009-08-17
Adrien de Beaupre
YAMWD: Yet Another Mass Web Defacement
2009-08-13
Johannes Ullrich
CA eTrust update crashes systems
2009-08-13
Jim Clausing
Tools for extracting files from pcaps
2009-07-28
Adrien de Beaupre
YYAMCCBA
2009-07-23
John Bambenek
Missouri Passes Breach Notification Law: Gap Still Exists for Banking Account Information
2009-07-12
Mari Nichols
CA Apologizes for False Positive
2009-06-30
Chris Carboni
Obfuscated Code
2009-06-30
Chris Carboni
De-Obfuscation Submissions
2009-06-28
Guy Bruneau
IP Address Range Search with libpcap
2009-06-26
Mark Hofman
PHPMYADMIN scans
2009-06-24
Kyle Haugsness
TCP scanning increase for 4899
2009-06-15
Daniel Wesemann
Drive-by Blackouting ?
2009-05-26
Jason Lam
A new Web application security blog
2009-05-20
Tom Liston
Web Toolz
2009-05-02
Rick Wanner
More Swine/Mexican/H1N1 related domains
2009-04-24
John Bambenek
Data Leak Prevention: Proactive Security Requirements of Breach Notification Laws
2009-04-21
Bojan Zdrnja
Web application vulnerabilities
2009-04-17
Joel Esler
Internet Storm Center Podcast Episode Number Fourteen
2009-04-07
Bojan Zdrnja
Advanced JavaScript obfuscation (or why signature scanning is a failure)
2009-04-03
Johannes Ullrich
Cyber Security Act of 2009
2009-03-24
G. N. White
CanSecWest Pwn2Own: Would IE8 have been exploitable had the event waited one more day?
2009-03-19
Mark Hofman
Browsers Tumble at CanSecWest
2009-03-02
Swa Frantzen
Obama's leaked chopper blueprints: anything we can learn?
2009-02-19
Joel Esler
Internet Storm Center Podcast Episode Number Thirteen
2009-02-14
Deborah Hale
Debit Card Compromise Letter
2009-02-13
Andre Ludwig
Third party information on conficker
2009-02-09
Johannes Ullrich
New ISC Feature: Micro Podcasts
2009-02-01
Chris Carboni
Scanning for Trixbox vulnerabilities
2009-01-30
Mark Hofman
Request for info - Scan and webmail
2009-01-12
William Salusky
Web Application Firewalls (WAF) - Have you deployed WAF technology?
2009-01-02
Mark Hofman
Blocking access to MD5 signed certs
2008-12-25
Maarten Van Horenbeeck
Christmas Ecard Malware
2008-12-12
Joel Esler
Internet Storm Center Podcast Episode Twelve
2008-11-29
Pedro Bueno
Possible Mumbai Scams?
2008-11-20
Jason Lam
Large quantity SQL Injection mitigation
2008-10-22
Joel Esler
Podcast Episode Eleven Posted
2008-09-29
Daniel Wesemann
Patchbag: WinZip / MPlayer / RealWin SCADA vuln
2008-09-09
Swa Frantzen
Evil side economy: $1 for breaking 1000 CAPTCHAs
2008-09-08
Raul Siles
CitectSCADA ODBC service exploit published
2008-09-07
Daniel Wesemann
Staying current, but not too current
2008-09-03
Daniel Wesemann
Static analysis of Shellcode - Part 2
2008-08-26
Joel Esler
Podcast Episode X Record Notice
2008-08-03
Deborah Hale
Securing A Network - Lessons Learned
2008-07-14
Daniel Wesemann
Obfuscated JavaScript Redux
2008-07-08
Joel Esler
Podcast Episode Eight Record Notice
2008-06-24
Joel Esler
Podcast Episode Seven Record Notice
2008-06-13
Joel Esler
Podcast Episode Six
2008-06-13
Johannes Ullrich
Floods: More of the same (2)
2008-06-11
John Bambenek
CitectSCADA Buffer Overflow Vulnerability
2008-06-01
Mark Hofman
Free Yahoo email account! Sign me up, Ok well maybe not.
2008-05-28
Joel Esler
Podcast Episode Five has been released
2008-05-26
Marcus Sachs
Predictable Response
2008-05-20
Joel Esler
Podcast Episode Four has been released
2008-05-19
Maarten Van Horenbeeck
Text message and telephone aid scams
2008-05-17
Jim Clausing
Disaster donation scams continue
2008-05-06
Marcus Sachs
Industrial Control Systems Vulnerability
2008-05-01
Joel Esler
ISC Podcast Episode Number 3
2008-04-25
Joel Esler
Hey, where is the podcast?
2008-04-22
donald smith
Spam to your calendar via Google agenda?
2008-04-16
William Stearns
Passer, a aassive machine and service sniffer
2008-04-09
Joel Esler
ISC Podcast Episode Number 2
2008-04-06
Daniel Wesemann
Advanced obfuscated JavaScript analysis
2008-04-03
Bojan Zdrnja
Mixed (VBScript and JavaScript) obfuscation
2008-03-27
Johannes Ullrich
Internet Storm Center Podcast
2006-09-01
Joel Esler
CA eTrust Antivirus [was] flagging lsass.e x e
Homepage
Diaries
Podcasts
Jobs
Data
TCP/UDP Port Activity
Port Trends
SSH/Telnet Scanning Activity
Weblogs
Threat Feeds Activity
Threat Feeds Map
Useful InfoSec Links
Presentations & Papers
Research Papers
API
Tools
DShield Sensor
DNS Looking Glass
Honeypot (RPi/AWS)
InfoSec Glossary
Contact Us
Contact Us
About Us
Handlers
About Us
Slack Channel
Mastodon
Bluesky
X
Follow updates by subscribing to the handler's
diary RSS feed