Changing BAT Files On The Fly, (Mon, Aug 2nd)

I often use Windows BAT files, simple ones, to execute a series of commands. And over the years, I learned not to change these BAT files while they were executing, because cmd.exe would "notice" those changes when it has to execute the next command in the BAT file, and read the changed file, leading to undesired results.

ISC Stormcast For Sunday, August 1st, 2021 https://isc.sans.edu/podcastdetail.html?id=7610, (Sun, Aug 1st)

procdump Version 10.1, (Sun, Aug 1st)

A new version of procdump, the Sysinternals tool to create process dumps, was released.

Unsolicited DNS Queries, (Sat, Jul 31st)

This week I started seeing more DNS related activity being identified by Threatintel and that got me curious. While reviewing my logs, I noticed that Wednesday and Thursday had an unusual spike for many inbound unsolicited DNS queries for the domain census.gov.

Infected With a .reg File, (Fri, Jul 30th)

Yesterday, I reported a piece of malware that uses archive.org to fetch its next stage[1]. Today, I spotted another file that is also interesting: A Windows Registry file (with a ".reg" extension). Such files are text files created by exporting values from the Registry (export) but they can also be used to add or change values in the Registry (import). Being text files, they don't look suspicious.

ISC Stormcast For Friday, July 30th, 2021 https://isc.sans.edu/podcastdetail.html?id=7608, (Fri, Jul 30th)

Malicious Content Delivered Through archive.org, (Thu, Jul 29th)

archive.org[1], also known as the "way back machine" is a very popular Internet site that allows you to travel back in time and browse old versions of a website (like the ISC website[2]). It works like regular search engines and continuously crawls the internet via bots. But there is another way to store content on archive.org: You may create an account and upload some content by yourself.

ISC Stormcast For Thursday, July 29th, 2021 https://isc.sans.edu/podcastdetail.html?id=7606, (Thu, Jul 29th)

A sextortion e-mail from...IT support?!, (Wed, Jul 28th)

E-mails claiming that their author has recorded the recipient through a webcam while they were "in flagrante delicto" enjoying a visit to some pornographic site, and will publish the recording unless the recipient pays them, have been with us for quite a while now. Over time, these messages haven’t changed much. It is no wonder – since the “hook” they use is fairly timeless and nearly universal in nature, the same messages can be effective for a long time without any substantial modifications.

ISC Stormcast For Wednesday, July 28th, 2021 https://isc.sans.edu/podcastdetail.html?id=7604, (Wed, Jul 28th)

Apple Patches for CVE-2021-30807, (Tue, Jul 27th)

Apple has released another update (previous update was only about 5 days ago) to address CVE-2021-30807 that was discovered by an anonymous researcher. This update resolves an issue with IOMobileFrameBuffer which could allow an application to execute arbitrary code with kernel privileges [1], [2]. This issue may have been actively exploited.

ISC Stormcast For Tuesday, July 27th, 2021 https://isc.sans.edu/podcastdetail.html?id=7602, (Tue, Jul 27th)

Failed Malspam: Recovering The Password, (Mon, Jul 26th)

Jan's diary entry "One way to fail at malspam - give recipients the wrong password for an encrypted attachment" got my attention: it's an opportunity for me to do some password cracking :-) I asked Jan for the sample.

ISC Stormcast For Monday, July 26th, 2021 https://isc.sans.edu/podcastdetail.html?id=7600, (Mon, Jul 26th)

Wireshark 3.4.7 Released, (Sun, Jul 25th)

Wireshark version 3.4.7 was released.

Active Directory Certificate Services (ADCS - PKI) domain admin vulnerability, (Sat, Jul 24th)

Phew, this was a really bad week for Microsoft (and a lot of reading for all of us). And just when we thought that the fiasco with the SAM hive was over, a new vulnerability popped up, which is much, much more dangerous unfortunately – it allows a user to completely take over a Windows domain that has the ADCS service running. And those are probably running in majority of enterprises.

Agent.Tesla Dropped via a .daa Image and Talking to Telegram, (Sat, Jul 24th)

A few days ago, I found an interesting file delivered by email (why change a winning combination?). The file has a nice extension: “.daa” (Direct Access Archive). We already reported such files in 2019 and Didier wrote a diary[1] about them. Default Windows installation, can’t process “.daa” files, you need a specific tool to open them (like PowerISO). I converted the archive into an ISO file and extracted the PE file inside it.

Uncovering Shenanigans in an IP Address Block via Hurricane Electric's BGP Toolkit (II), (Fri, Jul 23rd)

Today’s diary revisits hunting for dodgy domains via Hurricane Electric's BGP Toolkit [1]. This was previously done in an earlier diary [2], and I plan to do this occasionally to share potential or identified threats so that readers can be aware of them.

ISC Stormcast For Friday, July 23rd, 2021 https://isc.sans.edu/podcastdetail.html?id=7598, (Fri, Jul 23rd)

Lost in the Cloud: Akamai DNS Outage, (Thu, Jul 22nd)

As we already got a number of notes from readers: Currently, Akamai's DNS service appears to experience an outage that affects numerous other large websites. 

ISC Stormcast For Thursday, July 22nd, 2021 https://isc.sans.edu/podcastdetail.html?id=7596, (Thu, Jul 22nd)

"Summer of SAM": Microsoft Releases Guidance for CVE-2021-36934, (Wed, Jul 21st)

[UPDATE] Microsoft updated its article late yesterday (Wed July 21st). It now includes a list of vulnerable systems. Most notably, Windows Server, version 20H2 (Server Core Installation) and Windows Server, version 2004 (Server Core installation), Window Server 2019 (Server Core Installation, and "not Core). are affected. Earlier notes did not include any server operating systems.

ISC Stormcast For Wednesday, July 21st, 2021 https://isc.sans.edu/podcastdetail.html?id=7594, (Wed, Jul 21st)

Summer of SAM - incorrect permissions on Windows 10/11 hives, (Tue, Jul 20th)

If you opened Twitter today you were probably flooded with news about the latest security issue with Windows. For those that have ISC as their home page (yay!) the issue is the following: apparently starting with Windows 10 1809 (hey, that’s a version from 2018) Microsoft messed up permissions on the SAM and SYSTEM hives which became readable for any user on the system.

ISC Stormcast For Tuesday, July 20th, 2021 https://isc.sans.edu/podcastdetail.html?id=7592, (Tue, Jul 20th)

New Windows Print Spooler Vulnerability - CVE-2021-34481, (Mon, Jul 19th)

A new, unpatched, vulnerability has been discovered in the Windows Print Spooler and is being tracked under CVE-2021-34481.  Discovered by Jacob Baines at Dragos, this one requires local access, so it is less of a nightmare than PrintNightmare, but unfortunately the result of exploitation is SYSTEM level privileges.

ISC Stormcast For Monday, July 19th, 2021 https://isc.sans.edu/podcastdetail.html?id=7590, (Mon, Jul 19th)

Video: CyberChef BASE85 Decoding, (Sun, Jul 18th)

In this video, I show how to decode the sample of Xavier's diary entry "Multiple BaseXX Obfuscations" with CyberChef.

BASE85 Decoding With base64dump.py, (Sat, Jul 17th)

Xavier's diary entry "Multiple BaseXX Obfuscations" covers a malicious script that is encoded with different "base" encodings. Xavier starts with my tool base64dump.py, but he can not do the full decoding with base64dump, as it does not support BASE85.

Multiple BaseXX Obfuscations, (Fri, Jul 16th)

I found an interesting malicious Python script during my daily hunting routine. The script has a VT score of 2/58[1] (SHA256: 6990298edd0d66850578bfd1e1b9d42abfe7a8d1deb828ef0c7017281ee7c5b7). Its purpose is to perform the first stage of the infection. It downloads a shellcode, injects it into memory, and executes it. What’s interesting is the way obfuscation is implemented.

ISC Stormcast For Friday, July 16th, 2021 https://isc.sans.edu/podcastdetail.html?id=7588, (Fri, Jul 16th)

ISC Stormcast For Thursday, July 15th, 2021 https://isc.sans.edu/podcastdetail.html?id=7586, (Thu, Jul 15th)

USPS Phishing Using Telegram to Collect Data, (Tue, Jul 13th)

Phishing... at least they don't understand security any better than most kids. The latest example is a simple USPS phish. The lure is an email claiming that a package can not be delivered until I care to update my address. Urgency... and obvious action. They learned something in their phishing 101 class.

One way to fail at malspam - give recipients the wrong password for an encrypted attachment , (Wed, Jul 14th)

It is not unusual for malspam authors to encrypt the malicious files that they attach to messages they send out. Whether they encrypt the malicious file itself (as in the case of a password-protected Office document) or embed it in an encrypted archive, encryption can sometimes help attackers to get their creations past e-mail security scans.

ISC Stormcast For Wednesday, July 14th, 2021 https://isc.sans.edu/podcastdetail.html?id=7584, (Wed, Jul 14th)

Microsoft July 2021 Patch Tuesday, (Tue, Jul 13th)

This month we got patches for 117 vulnerabilities. Of these, 13 are critical, 6 were previously disclosed and 4 are being exploited according to Microsoft.

ISC Stormcast For Tuesday, July 13th, 2021 https://isc.sans.edu/podcastdetail.html?id=7582, (Tue, Jul 13th)

ISC Stormcast For Monday, July 12th, 2021 https://isc.sans.edu/podcastdetail.html?id=7580, (Mon, Jul 12th)

Scanning for Microsoft Secure Socket Tunneling Protocol, (Sat, Jul 10th)

Over the past month I noticed a resurgence of probe by Digitalocean looking for the Microsoft (MS) Secure Socket Tunneling Protocol (SSTP). This MS proprietary VPN protocol is used to establish a secure connection via the Transport Layer Security (TLS) between a client and a VPN gateway. Additional information on this protocol available here.

ISC Stormcast For Friday, July 9th, 2021 https://isc.sans.edu/podcastdetail.html?id=7578, (Fri, Jul 9th)

Hancitor tries XLL as initial malware file, (Fri, Jul 9th)

Introduction

Using Sudo with Python For More Security Controls, (Thu, Jul 8th)

I'm a big fan of the Sudo[1] command. This tool, available on every UNIX flavor, allows system administrators to provide access to certain users/groups to certain commands as root or another user. This is performed with a lot of granularity in the access rights and logging/reporting features. I'm using it for many years and I'm still learning great stuff about it. Yesterday, at the Pass-The-Salt[2] conference, Peter Czanik presented a great feature of Sudo (available since version 1.9): the ability to extend features using Python modules! There are several scenarios where Python can be used: 

ISC Stormcast For Thursday, July 8th, 2021 https://isc.sans.edu/podcastdetail.html?id=7576, (Thu, Jul 8th)

ISC Stormcast For Wednesday, July 7th, 2021 https://isc.sans.edu/podcastdetail.html?id=7574, (Wed, Jul 7th)

Microsoft Releases Patches for CVE-2021-34527, (Wed, Jul 7th)

Microsoft today released patches for CVE-2021-34527, the vulnerability also known as "printnightmare." Patches are now available for all affected versions of Windows (as long as they are still supported). Applying the update will also patch the older CVE-2021-1675 vulnerability.

Python DLL Injection Check, (Tue, Jul 6th)

They are many security tools that inject DLL into processes running on a Windows system. The classic examples are anti-virus products. They like to inject plenty of code that, combined with API hooking, implements security checks. If DLLs are injected into processes, they can be detected and it's a common anti-debugging or evasion technique implemented by many malware samples. If you're interested in such techniques, they are covered in the FOR610[1] training. The detection relies on a specific API call GetModuleFileName()[2]. The function expects the following parameters: A handle (pointer) to a process and the name of the DLL to check. Malware samples list all running processes, get a handle on them, and search for interesting DLL names. To get the handle, the OpenProcess()[3] API call must use the following access flag (0x0410 - PROCESS_VM_READ|PROCESS_QUERY_INFORMATION).

ISC Stormcast For Tuesday, July 6th, 2021 https://isc.sans.edu/podcastdetail.html?id=7572, (Tue, Jul 6th)

ISC Stormcast For Monday, July 5th, 2021 https://isc.sans.edu/podcastdetail.html?id=7570, (Sun, Jul 4th)

DIY CD/DVD Destruction - Follow Up, (Sun, Jul 4th)

Thanks a lot to all of you who posted a comment on my diary entry "DIY CD/DVD Destruction". They inspired me to try out some other methods.

Finding Strings With oledump.py, (Sat, Jul 3rd)

In diary entry "CFBF Files Strings Analysis" I show how to extract strings from CFBF/ole files with my tool oledump.py.

Kaseya VSA Users Hit by Ransomware, (Fri, Jul 2nd)

We are aware that some MSSP's customers (Managed Security Services Providers) have been hit by a ransomware. It seems that four(4) MSSP's have been affected until now. The ransomware was spread through the remote management solution "VSA"  provided by Kaseya[1]. This looks to be a brand new type of supply chain attack.

ISC Stormcast For Friday, July 2nd, 2021 https://isc.sans.edu/podcastdetail.html?id=7568, (Fri, Jul 2nd)

"inception.py"... Multiple Base64 Encodings, (Fri, Jul 2nd)

"Inception" is a very nice SF movie in which, if you did not watch it, dreams are implemented in people's minds to help to get access to sensitive information from their memory. Then, a dream is implemented into another dream, etc... up to five levels[1]! If you are not paying attention to the movie, you can be quickly lost. 

ISC Stormcast For Thursday, July 1st, 2021 https://isc.sans.edu/podcastdetail.html?id=7566, (Thu, Jul 1st)

Diving into a Google Sweepstakes Phishing E-mail, (Tue, Jun 29th)

I was recently forwarded another phishing e-mail to examine. This time, it was an e-mail that claimed to be from Google. The e-mail included a pdf file, and instructed the recipient download the file for further information. Figure 1 below shows the headers, while Figure 2 shows the content of the e-mail message.

ISC Stormcast For Wednesday, June 30th, 2021 https://isc.sans.edu/podcastdetail.html?id=7564, (Wed, Jun 30th)

June 2021 Forensic Contest: Answers and Analysis, (Wed, Jun 30th)

Introduction

ISC Stormcast For Tuesday, June 29th, 2021 https://isc.sans.edu/podcastdetail.html?id=7562, (Tue, Jun 29th)

CFBF Files Strings Analysis, (Mon, Jun 28th)

The Office file format that predates the OOXML format, is a binary format based on the CFBF format. I informally call this the ole file format.

ISC Stormcast For Monday, June 28th, 2021 https://isc.sans.edu/podcastdetail.html?id=7560, (Mon, Jun 28th)