ISC Stormcast For Monday, December 30th 2019 https://isc.sans.edu/podcastdetail.html?id=6804, (Mon, Dec 30th)

Miscellaneous Updates to our "Threatfeed" API, (Mon, Dec 30th)

Much of the data offered by us is available via our API [1]. A popular feature of our API is our "threat feeds." We use them to distribute lists of IP addresses and hostnames that you may want to block. In particular, our feeds of mining pool IPs and hosts used by Shodan are popular. This weekend, I added a feed for Onyphe [2]. Onyphe is comparable to Shodan, and I do see a lot of scans from them lately, which is why I added the feed. While I was messing with the API, I also added the ability to retrieve hostnames in addition to IP addresses.

ELK Dashboard for Pihole Logs, (Sun, Dec 29th)

In my last Pihole Diary, I shared a Pihole parser to collect its logs and stored them into Elastic. In this diary, I'm sharing a dashboard to visualize the Pihole DNS data. Here are some of the output from the dashboard.

Corrupt Office Documents, (Sat, Dec 28th)

My tool to analyze CFBF files, oledump.py, is not only used to analyze malicious Office documents.

Enumerating office365 users, (Fri, Dec 27th)

I found a pretty strange request in a University Firewall being sent over and over:

ISC Stormcast For Friday, December 27th 2019 https://isc.sans.edu/podcastdetail.html?id=6802, (Fri, Dec 27th)

Bypassing UAC to Install a Cryptominer, (Thu, Dec 26th)

First of all, Merry Christmas to all our readers! I hope you're enjoying the break with your family and friends! Even if everything slows down in this period, there is always malicious activity ongoing. I found a small PowerShell script that looked interesting for a quick diary. First of all, it has a VT score of 2/60[1]. It installs a cryptominer and its most interesting feature is the use of a classic technique to bypass UAC[2].

Merry christmas!, (Wed, Dec 25th)

We wish you and your families a merry christmas!

Timely acquisition of network traffic evidence in the middle of an incident response procedure, (Wed, Dec 25th)

The acquisition of evidence is one of the procedures that always brings controversy in incident management. We must answer questions such as:

Malspam with links to Word docs pushes IcedID (Bokbot), (Tue, Dec 24th)

Introduction

New oledump.py plugin: plugin_version_vba, (Mon, Dec 23rd)

In diary entry "VBA Office Document: Which Version?", I explain how to identify the Office version that was used to create a document with VBA macros.

ISC Stormcast For Monday, December 23rd 2019 https://isc.sans.edu/podcastdetail.html?id=6800, (Mon, Dec 23rd)

Extracting VBA Macros From .DWG Files, (Sun, Dec 22nd)

I updated my oledump.py tool to help with the analysis of files that embed OLE files, like AutoCAD's .dwg files with VBA macros.

Wireshark 3.2.0 Released, (Sat, Dec 21st)

Wireshark version 3.2.0 was released, with many improvements.

ISC Stormcast For Friday, December 20th 2019 https://isc.sans.edu/podcastdetail.html?id=6798, (Fri, Dec 20th)

More DNS over HTTPS: Become One With the Packet. Be the Query. See the Query, (Thu, Dec 19th)

Two days ago, I wrote about how to profile traffic to recognize DNS over HTTPS. This is kind of a problem for DNS over HTTPS. If you can see it, you may be able to block it. On Twitter, a few chimed in to provide feedback about recognizing DNS over HTTPS. I checked a couple of other clients, and well, didn't have a ton of time so this is still very preliminary:

ISC Stormcast For Thursday, December 19th 2019 https://isc.sans.edu/podcastdetail.html?id=6796, (Thu, Dec 19th)

ISC Stormcast For Wednesday, December 18th 2019 https://isc.sans.edu/podcastdetail.html?id=6794, (Wed, Dec 18th)

Emotet infection with spambot activity, (Wed, Dec 18th)

Introduction

Is it Possible to Identify DNS over HTTPs Without Decrypting TLS?, (Tue, Dec 17th)

Whenever I talk about DNS over HTTPS (DoH), the question comes up if it is possible to fingerprint DoH traffic without decrypting it. The idea is that something about DoH packets is different enough to identify them.

ISC Stormcast For Tuesday, December 17th 2019 https://isc.sans.edu/podcastdetail.html?id=6792, (Tue, Dec 17th)

ISC Stormcast For Monday, December 16th 2019 https://isc.sans.edu/podcastdetail.html?id=6790, (Mon, Dec 16th)

Malicious .DWG Files?, (Mon, Dec 16th)

This weekend, I took a look at AutoCAD drawing files (.dwg) with embedded VBA macros.

VirusTotal Email Submissions, (Sun, Dec 15th)

I think it's a good idea to highlight VirusTotal's Email Submission feature, as I recently had to point this out to a couple of people.

(Lazy) Sunday Maldoc Analysis: A Bit More ..., (Sat, Dec 14th)

At the end of my diary entry "(Lazy) Sunday Maldoc Analysis", I wrote that there was something unusal about this document.

Internet banking sites and their use of TLS... and SSLv3... and SSLv2?!, (Fri, Dec 13th)

Although SSLv3 has been considered obsolete and insecure for a long time, a large number of web servers still support its use. And even though the numbers are much lower, some servers on the web support SSLv2 to this day as well. And, as it turns out, this is true even when it comes to web servers hosting internet banking portals…

ISC Stormcast For Friday, December 13th 2019 https://isc.sans.edu/podcastdetail.html?id=6788, (Fri, Dec 13th)

Critical VMware Vulnerability (OpenSLP): https://www.vmware.com/security/advisories/VMSA-2019-0022.html, (Thu, Dec 12th)


Code & Data Reuse in the Malware Ecosystem, (Thu, Dec 12th)

In the past, I already had the opportunity to give some "security awareness" sessions to developers. One topic that was always debated is the reuse of existing code. Indeed, for a developer, it's tempting to not reinvent the wheel when somebody already wrote a piece of code that achieves the expected results. From a gain of time perspective, it's a win for the developers who can focus on other code. Of course, this can have side effects and introduce bugs, backdoors, etc... but it's not today's topic. Malware developers are also developers and have the same behavior. Code reuse has been already discussed several times[1]. For example, tools exist to detect cloned or reused code in the IDA disassembler[2][3].

ISC Stormcast For Thursday, December 12th 2019 https://isc.sans.edu/podcastdetail.html?id=6786, (Thu, Dec 12th)

ISC Stormcast For Wednesday, December 11th 2019 https://isc.sans.edu/podcastdetail.html?id=6784, (Wed, Dec 11th)

German language malspam pushes yet another wave of Trickbot, (Wed, Dec 11th)

Introduction

Microsoft December 2019 Patch Tuesday, (Tue, Dec 10th)

This month we got patches for 36 vulnerabilities total. From those, seven are rated critical and one is already being exploited according to Microsoft. 

ISC Stormcast For Tuesday, December 10th 2019 https://isc.sans.edu/podcastdetail.html?id=6782, (Tue, Dec 10th)

ISC Stormcast For Monday, December 9th 2019 https://isc.sans.edu/podcastdetail.html?id=6780, (Mon, Dec 9th)

(Lazy) Sunday Maldoc Analysis, (Mon, Dec 9th)

I received another malicious Word document: with VBA macros and string obfuscation, launching a PowerShell downloader. As classic as they come.

Wireshark 3.0.7 Released, (Sun, Dec 8th)

Wireshark version 3.0.7 was released.

Integrating Pi-hole Logs in ELK with Logstash, (Sat, Dec 7th)

I wanted to parse and ingest my Pi-hole DNS logs for a while now in Elasticsearch to be able to analyze them in various ways. I wrote four separate Grok parser for Logstash to send the logs to a ELK stack. I am now able to view and analyze which domains have been Sinkhole by gravity.list or regex.list (custom wildcard lists) and create the necessary dashboards to report on the DNS traffic. This is an example of the output in Discover. In this example, I have filtered out the dns_type: forwarded.

Phishing with a self-contained credentials-stealing webpage, (Fri, Dec 6th)

Phishing e-mails which are used to steal credentials usually depend on user clicking a link which leads to a phishing website that looks like login page for some valid service. Not all credentials-stealing has to be done using a remote website, however.

ISC Stormcast For Friday, December 6th 2019 https://isc.sans.edu/podcastdetail.html?id=6778, (Fri, Dec 6th)

E-mail from Agent Tesla, (Thu, Dec 5th)

Last Thursday, only a day after Brad wrote a Diary about discovering Agent Tesla sample in Any.Run[1], I found a request for analysis of a suspicious file in my inbox. The file turned out to be the first part of a multi-stage downloader for Agent Tesla and since Brad wrote about what happens after this malware arrives at the target (i.e. data exfiltration using SMTP), I thought that a closer look at what comes before the infection might nicely complete the picture of how the malware operates.

ISC Stormcast For Thursday, December 5th 2019 https://isc.sans.edu/podcastdetail.html?id=6776, (Thu, Dec 5th)

Analysis of a strangely poetic malware, (Wed, Dec 4th)

Although given its name, one might expect this diary to be about the Elk Cloner[1], that is not the case. The malware we will take a look at is recent and much simpler, yet still interesting in its own way.

ISC Stormcast For Wednesday, December 4th 2019 https://isc.sans.edu/podcastdetail.html?id=6774, (Wed, Dec 4th)

ISC Stormcast For Tuesday, December 3rd 2019 https://isc.sans.edu/podcastdetail.html?id=6772, (Tue, Dec 3rd)

Ursnif infection with Dridex, (Tue, Dec 3rd)

Introduction

Next up, what's up with TCP port 26?, (Mon, Dec 2nd)

Whenever I sign up for another shift, if I don't already have a diary topic in mind, I take a look at the top 10 ports in the dashboard when I login to isc.sans.edu. For the last few weeks, I've noticed %%port:26%% showing up, so I decided to see if I could figure out what was going on there.

ISC Stormcast For Monday, December 2nd 2019 https://isc.sans.edu/podcastdetail.html?id=6770, (Mon, Dec 2nd)

ISC Snapshot: Search with SauronEye, (Fri, Nov 29th)

SauronEye is a search tool built to aid red teams in finding files containing specific keywords.

ISC Stormcast For Wednesday, November 27th 2019 https://isc.sans.edu/podcastdetail.html?id=6768, (Wed, Nov 27th)

Finding an Agent Tesla malware sample, (Wed, Nov 27th)

I was browsing through the Any Run sandbox looking through the public submissions of malware with pcaps of infection traffic from Tuesday 2019-11-26.  I found this one, and it's tagged agenttesla.  Agent Tesla is an information stealer.  Based on the file name, this Agent Tesla malware sample may have been disguised as an installer for Discord.

Lessons learned from playing a willing phish, (Tue, Nov 26th)

Replying to phishing e-mails can lead to some interesting experiences (besides falling for the scams they offer, that is). Since it doesn’t require a deep technical know-how or any special expertise, it is something I recommend everyone to try out at least once, as it can lead to some funny moments and show us that the phishing trade doesn’t always operate in the way we might expect it to.

ISC Stormcast For Tuesday, November 26th 2019 https://isc.sans.edu/podcastdetail.html?id=6766, (Tue, Nov 26th)

My Little DoH Setup, (Mon, Nov 25th)

"DoH"[1], this 3-letters acronym is a buzzword on the Internet in 2019! It has been implemented in Firefox, Microsoft announced that Windows will support it soon. They are pro & con about encrypting DNS requests in  HTTPS but it's not the goal of this diary to restart the debate. In a previous diary, he explained how to prevent DoH to be used by Firefox[2] but, this time, I'll play on the other side and explain to you how to implement it in a way to keep control of your DNS traffic (read: how to keep an eye on DNS request performed by users and systems). For a while, I had the idea to test a DoH configuration but I had some requirements:

ISC Stormcast For Monday, November 25th 2019 https://isc.sans.edu/podcastdetail.html?id=6764, (Mon, Nov 25th)

Local Malware Analysis with Malice, (Sat, Nov 23rd)

This project (Malice) provides the ability to have your own locally managed multi-engine malware scanning system. The framework allows the owner to analyze files for known malware. It can be used both as a command tool to analyze samples and review the results via a Kibana web interface. The Command-Line Interface (CLI) is used to scan a file or directory or can be setup to watch and scan new files when copied into a write only directory.

Abusing Web Filters Misconfiguration for Reconnaissance, (Fri, Nov 22nd)

Yesterday, an interesting incident was detected while working at a customer SOC. They use a “next-generation” firewall that implements a web filter based on categories. This is common in many organizations today: Users' web traffic is allowed/denied based on an URL categorization database (like “adult content”, “hacking”, “gambling”, …). How was it detected? 

ISC Stormcast For Friday, November 22nd 2019 https://isc.sans.edu/podcastdetail.html?id=6762, (Fri, Nov 22nd)

Gathering information to determine unusual network traffic, (Thu, Nov 21st)

When working with threat intelligence, it's vital to collect indicators of compromise to be able to determine possible attack patterns. What could be catalogued as unusual network traffic? This is all traffic that is not being seen normally in the network, meaning that after building a frequence table all IP addresses shown less than 1% are suspicious and should be investigated.

ISC Stormcast For Thursday, November 21st 2019 https://isc.sans.edu/podcastdetail.html?id=6760, (Thu, Nov 21st)