Diaries by Keyword - SANS Internet Storm Center

Handler on Duty: Jan Kopriva

Threat Level: green

Date	Author	Title
IN MEMORY
2020-07-27	Johannes Ullrich	In Memory of Donald Smith
IN
2024-11-22/a>	Xavier Mertens	An Infostealer Searching for « BIP-0039 » Data
2024-11-19/a>	Xavier Mertens	Detecting the Presence of a Debugger in Linux
2024-11-17/a>	Johannes Ullrich	Ancient TP-Link Backdoor Discovered by Attackers
2024-11-07/a>	Xavier Mertens	Steam Account Checker Poisoned with Infostealer
2024-10-31/a>	Guy Bruneau	October 2024 Activity with Username chenzilong
2024-10-14/a>	Xavier Mertens	Phishing Page Delivered Through a Blob URL
2024-10-09/a>	Xavier Mertens	From Perfctl to InfoStealer
2024-10-03/a>	Guy Bruneau	Kickstart Your DShield Honeypot [Guest Diary]
2024-09-25/a>	Guy Bruneau	OSINT - Image Analysis or More Where, When, and Metadata [Guest Diary]
2024-09-18/a>	Guy Bruneau	Time-to-Live Analysis of DShield Data with Vega-Lite
2024-09-18/a>	Xavier Mertens	Python Infostealer Patching Windows Exodus App
2024-09-11/a>	Guy Bruneau	Hygiene, Hygiene, Hygiene! [Guest Diary]
2024-09-04/a>	Guy Bruneau	Attack Surface [Guest Diary]
2024-08-30/a>	Jesse La Grew	Simulating Traffic With Scapy
2024-08-29/a>	Xavier Mertens	Live Patching DLLs with Python
2024-08-27/a>	Xavier Mertens	Why Is Python so Popular to Infect Windows Hosts?
2024-08-27/a>	Guy Bruneau	Vega-Lite with Kibana to Parse and Display IP Activity over Time
2024-08-26/a>	Xavier Mertens	From Highly Obfuscated Batch File to XWorm and Redline
2024-08-20/a>	Guy Bruneau	Mapping Threats with DNSTwist and the Internet Storm Center [Guest Diary]
2024-08-16/a>	Jesse La Grew	[Guest Diary] 7 minutes and 4 steps to a quick win: A write-up on custom tools
2024-08-14/a>	Xavier Mertens	Multiple Malware Dropped Through MSI Package
2024-08-07/a>	Guy Bruneau	Same Scripts, Different Day: What My DShield Honeypot Taught Me About the Importance of Security Fundamentals [Guest Diary]
2024-07-25/a>	Xavier Mertens	XWorm Hidden With Process Hollowing
2024-07-23/a>	Johannes Ullrich	New Exploit Variation Against D-Link NAS Devices (CVE-2024-3273)
2024-07-16/a>	Jan Kopriva	"Reply-chain phishing" with a twist
2024-07-16/a>	Guy Bruneau	Who You Gonna Call? AndroxGh0st Busters! [Guest Diary]
2024-07-13/a>	Didier Stevens	16-bit Hash Collisions in .xls Spreadsheets
2024-07-10/a>	Jesse La Grew	Finding Honeypot Data Clusters Using DBSCAN: Part 1
2024-07-08/a>	Xavier Mertens	Kunai: Keep an Eye on your Linux Hosts Activity
2024-06-26/a>	Guy Bruneau	What Setting Live Traps for Cybercriminals Taught Me About Security [Guest Diary]
2024-06-20/a>	Guy Bruneau	No Excuses, Free Tools to Help Secure Authentication in Ubuntu Linux [Guest Diary]
2024-06-13/a>	Guy Bruneau	The Art of JQ and Command-line Fu [Guest Diary]
2024-05-31/a>	Xavier Mertens	"K1w1" InfoStealer Uses gofile.io for Exfiltration
2024-05-30/a>	Xavier Mertens	Feeding MISP with OSSEC
2024-05-28/a>	Guy Bruneau	Is that It? Finding the Unknown: Correlations Between Honeypot Logs & PCAPs [Guest Diary]
2024-05-22/a>	Rob VandenBrink	NMAP Scanning without Scanning (Part 2) - The ipinfo API
2024-05-22/a>	Guy Bruneau	Analysis of ?redtail? File Uploads to ICS Honeypot, a Multi-Architecture Coin Miner [Guest Diary]
2024-05-16/a>	Rob VandenBrink	Why yq? Adventures in XML
2024-05-15/a>	Rob VandenBrink	Got MFA? If not, Now is the Time!
2024-05-06/a>	Johannes Ullrich	Detecting XFinity/Comcast DNS Spoofing
2024-04-29/a>	Johannes Ullrich	D-Link NAS Device Backdoor Abused
2024-04-29/a>	Guy Bruneau	Linux Trojan - Xorddos with Filename eyshcjdmzg
2024-04-22/a>	Jan Kopriva	It appears that the number of industrial devices accessible from the internet has risen by 30 thousand over the past three years
2024-04-17/a>	Xavier Mertens	Malicious PDF File Used As Delivery Mechanism
2024-04-11/a>	Yee Ching Tok	Evolution of Artificial Intelligence Systems and Ensuring Trustworthiness
2024-04-07/a>	Guy Bruneau	A Use Case for Adding Threat Hunting to Your Security Operations Team. Detecting Adversaries Abusing Legitimate Tools in A Customer Environment. [Guest Diary]
2024-03-19/a>	Johannes Ullrich	Attacker Hunting Firewalls
2024-03-17/a>	Guy Bruneau	Gamified Learning: Using Capture the Flag Challenges to Supplement Cybersecurity Training [Guest Diary]
2024-03-14/a>	Jan Kopriva	Increase in the number of phishing messages pointing to IPFS and to R2 buckets
2024-03-06/a>	Bojan Zdrnja	Scanning and abusing the QUIC protocol
2024-02-21/a>	Jan Kopriva	Phishing pages hosted on archive.org
2024-02-20/a>	Xavier Mertens	Python InfoStealer With Dynamic Sandbox Detection
2024-02-15/a>	Jesse La Grew	[Guest Diary] Learning by doing: Iterative adventures in troubleshooting
2024-01-31/a>	Johannes Ullrich	The Fun and Dangers of Top Level Domains (TLDs)
2024-01-25/a>	Xavier Mertens	Facebook AdsManager Targeted by a Python Infostealer
2024-01-24/a>	Johannes Ullrich	How Bad User Interfaces Make Security Tools Harmful
2024-01-06/a>	Xavier Mertens	Are you sure of your password?
2024-01-02/a>	Johannes Ullrich	Fingerprinting SSH Identification Strings
2023-12-31/a>	Tom Webb	Pi-Hole Pi4 Docker Deployment
2023-12-22/a>	Xavier Mertens	Shall We Play a Game?
2023-12-06/a>	Guy Bruneau	Revealing the Hidden Risks of QR Codes [Guest Diary]
2023-11-30/a>	John Bambenek	Prophetic Post by Intern on CVE-2023-1389 Foreshadows Mirai Botnet Expansion Today
2023-11-22/a>	Guy Bruneau	CVE-2023-1389: A New Means to Expand Botnets
2023-11-17/a>	Jan Kopriva	Phishing page with trivial anti-analysis features
2023-11-15/a>	Xavier Mertens	Redline Dropped Through MSIX Package
2023-11-09/a>	Xavier Mertens	Visual Examples of Code Injection
2023-11-08/a>	Xavier Mertens	Example of Phishing Campaign Project File
2023-10-29/a>	Guy Bruneau	Spam or Phishing? Looking for Credentials & Passwords
2023-10-28/a>	Xavier Mertens	Size Matters for Many Security Controls
2023-10-16/a>	Jan Kopriva	Are typos still relevant as an indicator of phishing?
2023-10-15/a>	Guy Bruneau	Domain Name Used as Password Captured by DShield Sensor
2023-10-03/a>	Tom Webb	Are Local LLMs Useful in Incident Response?
2023-09-29/a>	Xavier Mertens	Are You Still Storing Passwords In Plain Text Files?
2023-09-26/a>	Jan Kopriva	A new spin on the ZeroFont phishing technique
2023-09-23/a>	Guy Bruneau	Scanning for Laravel - a PHP Framework for Web Artisants
2023-09-03/a>	Didier Stevens	Analysis of a Defective Phishing PDF
2023-08-31/a>	Jan Kopriva	The low, low cost of (committing) cybercrime
2023-08-31/a>	Guy Bruneau	Potential Weaponizing of Honeypot Logs [Guest Diary]
2023-08-21/a>	Xavier Mertens	Quick Malware Triage With Inotify Tools
2023-08-20/a>	Guy Bruneau	SystemBC Malware Activity
2023-08-18/a>	Xavier Mertens	From a Zalando Phishing to a RAT
2023-08-17/a>	Jesse La Grew	Command Line Parsing - Are These Really Unique Strings?
2023-08-11/a>	Xavier Mertens	Show me All Your Windows!
2023-07-24/a>	Rob VandenBrink	JQ: Another Tool We Thought We Knew
2023-07-18/a>	Johannes Ullrich	Exploit Attempts for "Stagil navigation for Jira Menus & Themes" CVE-2023-26255 and CVE-2023-26256
2023-07-13/a>	Jesse La Grew	DShield Honeypot Maintenance and Data Retention
2023-07-01/a>	Russ McRee	Sandfly Security
2023-06-29/a>	Brad Duncan	GuLoader- or DBatLoader/ModiLoader-style infection for Remcos RAT
2023-06-21/a>	Yee Ching Tok	Analyzing a YouTube Sponsorship Phishing Mail and Malware Targeting Content Creators
2023-06-19/a>	Xavier Mertens	Malware Delivered Through .inf File
2023-06-16/a>	Xavier Mertens	Another RAT Delivered Through VBS
2023-05-30/a>	Johannes Ullrich	Your Business Data and Machine Learning at Risk: Attacks Against Apache NiFi
2023-05-28/a>	Guy Bruneau	We Can no Longer Ignore the Cost of Cybersecurity
2023-05-26/a>	Xavier Mertens	Using DFIR Techniques To Recover From Infrastructure Outages
2023-05-24/a>	Tom Webb	IR Case/Alert Management
2023-05-20/a>	Xavier Mertens	Phishing Kit Collecting Victim's IP Address
2023-05-19/a>	Xavier Mertens	When the Phisher Messes Up With Encoding
2023-05-15/a>	Jan Kopriva	Ongoing Facebook phishing campaign without a sender and (almost) without links
2023-05-04/a>	Xavier Mertens	Infostealer Embedded in a Word Document
2023-05-01/a>	Jan Kopriva	"Passive" analysis of a phishing attachment
2023-04-26/a>	Yee Ching Tok	Strolling through Cyberspace and Hunting for Phishing Sites
2023-04-17/a>	Jan Kopriva	The strange case of Great honeypot of China
2023-04-08/a>	Xavier Mertens	Microsoft Netlogon: Potential Upcoming Impacts of CVE-2022-38023
2023-04-03/a>	Johannes Ullrich	Tax Season Risks
2023-03-31/a>	Guy Bruneau	Using Linux grep and Windows findstr to Manipulate Files
2023-03-31/a>	Jan Kopriva	Use of X-Frame-Options and CSP frame-ancestors security headers on 1 million most popular domains
2023-03-25/a>	Guy Bruneau	Microsoft Released an Update for Windows Snipping Tool Vulnerability
2023-03-22/a>	Didier Stevens	Windows 11 Snipping Tool Privacy Bug: Inspecting PNG Files
2023-03-20/a>	Xavier Mertens	From Phishing Kit To Telegram... or Not!
2023-03-15/a>	Jan Kopriva	IPFS phishing and the need for correctly set HTTP security headers
2023-03-12/a>	Guy Bruneau	AsynRAT Trojan - Bill Payment (Pago de la factura)
2023-03-11/a>	Xavier Mertens	Overview of a Mirai Payload Generator
2023-03-01/a>	Xavier Mertens	Python Infostealer Targeting Gamers
2023-02-27/a>	Xavier Mertens	Phishing Again and Again
2023-02-21/a>	Xavier Mertens	Phishing Page Branded with Your Corporate Website
2023-02-19/a>	Didier Stevens	"Unsupported 16-bit Application" or HTML?
2023-02-18/a>	Guy Bruneau	Spear Phishing Handlers for Username/Password
2023-02-16/a>	Jan Kopriva	HTML phishing attachment with browser-in-the-browser technique
2023-02-13/a>	Johannes Ullrich	Venmo Phishing Abusing LinkedIn "slink"
2023-02-10/a>	Xavier Mertens	Obfuscated Deactivation of Script Block Logging
2023-02-09/a>	Xavier Mertens	A Backdoor with Smart Screenshot Capability
2023-02-04/a>	Guy Bruneau	Assemblyline as a Malware Analysis Sandbox
2023-01-28/a>	Didier Stevens	Sysinternals Updates: RDCMan v2.92, Sysmon v14.14, and ZoomIt v6.12
2023-01-26/a>	Tom Webb	Live Linux IR with UAC
2023-01-23/a>	Xavier Mertens	Who's Resolving This Domain?
2023-01-21/a>	Guy Bruneau	DShield Sensor JSON Log to Elasticsearch
2023-01-15/a>	Johannes Ullrich	Elon Musk Themed Crypto Scams Flooding YouTube Today
2023-01-08/a>	Guy Bruneau	DShield Sensor JSON Log Analysis
2023-01-02/a>	Xavier Mertens	NetworkMiner 2.8 Released
2022-12-21/a>	Guy Bruneau	DShield Sensor Setup in Azure
2022-12-20/a>	Xavier Mertens	Linux File System Monitoring & Actions
2022-12-19/a>	Xavier Mertens	Hunting for Mastodon Servers
2022-12-18/a>	Guy Bruneau	Infostealer Malware with Double Extension
2022-12-04/a>	Didier Stevens	Finger.exe LOLBin
2022-12-03/a>	Guy Bruneau	Linux LOLBins Applications Available in Windows
2022-12-02/a>	Brad Duncan	obama224 distribution Qakbot tries .vhd (virtual hard disk) images
2022-11-29/a>	Johannes Ullrich	Identifying Groups of "Bot" Accounts on LinkedIn
2022-11-28/a>	Johannes Ullrich	Ukraine Themed Twitter Spam Pushing iOS Scareware
2022-11-24/a>	Xavier Mertens	Attackers Keep Phishing Victims Under Stress
2022-11-19/a>	Guy Bruneau	McAfee Fake Antivirus Phishing Campaign is Back!
2022-11-10/a>	Xavier Mertens	Do you collect "Observables" or "IOCs"?
2022-11-05/a>	Guy Bruneau	Windows Malware with VHD Extension
2022-11-02/a>	Rob VandenBrink	Breakpoints in Burp
2022-10-30/a>	Didier Stevens	Sysinternals Updates: Process Explorer v17.0, Handle v5.0, Process Monitor v3.92 and Sysmon v14.11
2022-10-27/a>	Tom Webb	Supersizing your DUO and 365 Integration
2022-10-19/a>	Xavier Mertens	Are Internet Scanning Services Good or Bad for You?
2022-10-15/a>	Guy Bruneau	Malware - Covid Vaccination Supplier Declaration
2022-10-07/a>	Xavier Mertens	Powershell Backdoor with DGA Capability
2022-10-07/a>	Xavier Mertens	Critical Fortinet Vulnerability Ahead
2022-10-04/a>	Johannes Ullrich	Credential Harvesting with Telegram API
2022-09-21/a>	Xavier Mertens	Phishing Campaigns Use Free Online Resources
2022-09-19/a>	Russ McRee	Chainsaw: Hunt, search, and extract event log records
2022-09-15/a>	Xavier Mertens	Malicious Word Document with a Frameset
2022-09-14/a>	Xavier Mertens	Easy Process Injection within Python
2022-09-10/a>	Guy Bruneau	Phishing Word Documents with Suspicious URL
2022-08-28/a>	Didier Stevens	Sysinternals Updates: Sysmon v14.0 and ZoomIt v6.01
2022-08-26/a>	Xavier Mertens	Paypal Phishing/Coinbase in One Image
2022-08-26/a>	Guy Bruneau	HTTP/2 Packet Analysis with Wireshark
2022-08-13/a>	Guy Bruneau	Phishing HTML Attachment as Voicemail Audio Transcription
2022-08-11/a>	Xavier Mertens	InfoStealer Script Based on Curl and NSudo
2022-08-02/a>	Johannes Ullrich	A Little DDoS in the Morning - Followup
2022-08-02/a>	Johannes Ullrich	Increase in Chinese "Hacktivism" Attacks
2022-08-01/a>	Johannes Ullrich	A Little DDoS In the Morning
2022-07-28/a>	Johannes Ullrich	Exfiltrating Data With Bookmarks
2022-07-25/a>	Xavier Mertens	PowerShell Script with Fileless Capability
2022-07-23/a>	Guy Bruneau	Analysis of SSH Honeypot Data with PowerBI
2022-07-22/a>	Yee Ching Tok	An Analysis of a Discerning Phishing Website
2022-07-20/a>	Xavier Mertens	Malicious Python Script Behaving Like a Rubber Ducky
2022-07-20/a>	Johannes Ullrich	Apple Patches Everything Day
2022-07-13/a>	Xavier Mertens	Using Referers to Detect Phishing Attacks
2022-07-09/a>	Didier Stevens	7-Zip Editing & MoW
2022-06-26/a>	Didier Stevens	My Paste Command
2022-06-24/a>	Xavier Mertens	Python (ab)using The Windows GUI
2022-06-23/a>	Xavier Mertens	FLOSS 2.0 Has Been Released
2022-06-21/a>	Johannes Ullrich	Experimental New Domain / Domain Age API
2022-06-19/a>	Didier Stevens	Video: Decoding Obfuscated BASE64 Statistically
2022-06-18/a>	Didier Stevens	Decoding Obfuscated BASE64 Statistically
2022-06-16/a>	Xavier Mertens	Houdini is Back Delivered Through a JavaScript Dropper
2022-06-12/a>	Didier Stevens	Quickie: Follina, RTF & Explorer Preview Pane
2022-06-09/a>	Brad Duncan	TA570 Qakbot (Qbot) tries CVE-2022-30190 (Follina) exploit (ms-msdt)
2022-06-02/a>	Johannes Ullrich	Quick Answers in Incident Response: RECmd.exe
2022-06-01/a>	Jan Kopriva	HTML phishing attachments - now with anti-analysis features
2022-05-31/a>	Xavier Mertens	First Exploitation of Follina Seen in the Wild
2022-05-18/a>	Jan Kopriva	Do you want 30 BTC? Nothing is easier (or cheaper) in this phishing campaign...
2022-05-14/a>	Didier Stevens	Quick Analysis Of Phishing MSG
2022-05-07/a>	Guy Bruneau	Phishing PDF Received in my ISC Mailbox
2022-04-28/a>	Johannes Ullrich	A Day of SMB: What does our SMB/RPC Honeypot see? CVE-2022-26809
2022-04-24/a>	Didier Stevens	Analyzing a Phishing Word Document
2022-04-23/a>	Guy Bruneau	Are Roku Streaming Devices Safe from Exploitation?
2022-04-14/a>	Johannes Ullrich	An Update on CVE-2022-26809 - MSRPC Vulnerabliity - PATCH NOW
2022-04-13/a>	Jan Kopriva	How is Ukrainian internet holding up during the Russian invasion?
2022-04-11/a>	Johannes Ullrich	Spring: It isn't just about Spring4Shell. Spring Cloud Function Vulnerabilities are being probed too.
2022-04-10/a>	Didier Stevens	Video: Method For String Extraction Filtering
2022-04-09/a>	Didier Stevens	Method For String Extraction Filtering
2022-04-07/a>	Johannes Ullrich	What is BIMI and how is it supposed to help with Phishing.
2022-04-06/a>	Brad Duncan	Windows MetaStealer Malware
2022-04-05/a>	Johannes Ullrich	WebLogic Crypto Miner Malware Disabling Alibaba Cloud Monitoring Tools
2022-04-04/a>	Johannes Ullrich	Emptying the Phishtank: Are WordPress sites the Mosquitoes of the Internet?
2022-03-31/a>	Johannes Ullrich	Spring Vulnerability Update - Exploitation Attempts CVE-2022-22965
2022-03-30/a>	Johannes Ullrich	Possible new Java Spring Framework Vulnerability (Updated: not a Spring problem)
2022-03-30/a>	Johannes Ullrich	Java Springtime Confusion: What Vulnerability are We Talking About
2022-03-29/a>	Johannes Ullrich	More Fake/Typosquatting Twitter Accounts Asking for Ukraine Crytocurrency Donations
2022-03-26/a>	Guy Bruneau	Is buying Cyber Insurance a Must Now?
2022-03-25/a>	Xavier Mertens	XLSB Files: Because Binary is Stealthier Than XML
2022-03-24/a>	Xavier Mertens	Malware Delivered Through Free Sharing Tool
2022-03-23/a>	Brad Duncan	Arkei Variants: From Vidar to Mars Stealer
2022-03-22/a>	Johannes Ullrich	Statement by President Biden: What you need to do (or not do)
2022-03-15/a>	Xavier Mertens	Clean Binaries with Suspicious Behaviour
2022-03-09/a>	Xavier Mertens	Infostealer in a Batch File
2022-03-07/a>	Johannes Ullrich	No Bitcoin - No Problem: Follow Up to Last Weeks Donation Scam
2022-03-04/a>	Johannes Ullrich	Scam E-Mail Impersonating Red Cross
2022-03-02/a>	Johannes Ullrich	The More Often Something is Repeated, the More True It Becomes: Dealing with Social Media
2022-02-25/a>	Didier Stevens	Windows, Fixed IPv4 Addresses and APIPA
2022-02-24/a>	Xavier Mertens	Ukraine & Russia Situation From a Domain Names Perspective
2022-02-13/a>	Guy Bruneau	DHL Spear Phishing to Capture Username/Password
2022-02-11/a>	Xavier Mertens	CinaRAT Delivered Through HTML ID Attributes
2022-02-10/a>	Johannes Ullrich	Zyxel Network Storage Devices Hunted By Mirai Variant
2022-02-05/a>	Didier Stevens	Power over Ethernet and Thermal Imaging
2022-02-02/a>	Johannes Ullrich	Finding elFinder: Who is looking for your files?
2022-01-31/a>	Xavier Mertens	Be careful with RPMSG files
2022-01-29/a>	Guy Bruneau	SIEM In this Decade, Are They Better than the Last?
2022-01-28/a>	Xavier Mertens	Malicious ISO Embedded in an HTML Page
2022-01-21/a>	Xavier Mertens	Obscure Wininet.dll Feature?
2022-01-20/a>	Xavier Mertens	RedLine Stealer Delivered Through FTP
2022-01-18/a>	Jan Kopriva	Phishing e-mail with...an advertisement?
2022-01-05/a>	Xavier Mertens	Code Reuse In the Malware Landscape
2022-01-04/a>	Xavier Mertens	A Simple Batch File That Blocks People
2022-01-03/a>	Xavier Mertens	McAfee Phishing Campaign with a Nice Fake Scan
2022-01-02/a>	Guy Bruneau	Exchange Server - Email Trapped in Transport Queues
2021-12-28/a>	Russ McRee	LotL Classifier tests for shells, exfil, and miners
2021-12-23/a>	Xavier Mertens	Nicely Crafted indeed.com Login Page
2021-12-21/a>	Xavier Mertens	More Undetected PowerShell Dropper
2021-12-20/a>	Jan Kopriva	PowerPoint attachments, Agent Tesla and code reuse in malware
2021-12-14/a>	Johannes Ullrich	Log4j: Getting ready for the long haul (CVE-2021-44228)
2021-12-10/a>	Xavier Mertens	Python Shellcode Injection From JSON Data
2021-12-09/a>	Yee Ching Tok	Phishing Direct Messages via Discord
2021-12-06/a>	Xavier Mertens	The Importance of Out-of-Band Networks
2021-12-04/a>	Guy Bruneau	A Review of Year 2021
2021-12-01/a>	Xavier Mertens	Info-Stealer Using webhook.site to Exfiltrate Data
2021-11-25/a>	Didier Stevens	YARA's Private Strings
2021-11-24/a>	Jan Kopriva	Phishing page hiding itself using dynamically adjusted IP-based allow list
2021-11-21/a>	Didier Stevens	Backdooring PAM
2021-11-20/a>	Guy Bruneau	Hikvision Security Cameras Potentially Exposed to Remote Code Execution
2021-11-19/a>	Xavier Mertens	Downloader Disguised as Excel Add-In (XLL)
2021-11-10/a>	Xavier Mertens	Shadow IT Makes People More Vulnerable to Phishing
2021-10-31/a>	Didier Stevens	Sysinternals: Autoruns and Sysmon updates
2021-10-30/a>	Guy Bruneau	Remote Desktop Protocol (RDP) Discovery
2021-10-26/a>	Yee Ching Tok	Hunting for Phishing Sites Masquerading as Outlook Web Access
2021-10-14/a>	Xavier Mertens	Port-Forwarding with Windows for the Win
2021-10-13/a>	Johannes Ullrich	Please fix your E-Mail Brute forcing tool!
2021-10-09/a>	Guy Bruneau	Scanning for Previous Oracle WebLogic Vulnerabilities
2021-10-07/a>	Johannes Ullrich	Who Is Hunting For Your IPTV Set-Top Box?
2021-09-25/a>	Didier Stevens	Strings Analysis: VBA & Excel4 Maldoc
2021-09-25/a>	Didier Stevens	Video: Strings Analysis: VBA & Excel4 Maldoc
2021-09-24/a>	Xavier Mertens	Keep an Eye on Your Users Mobile Devices (Simple Inventory)
2021-09-20/a>	Johannes Ullrich	#OMIGOD Exploits Captured in the Wild. Researchers responsible for half of scans for related ports.
2021-09-16/a>	Jan Kopriva	Phishing 101: why depend on one suspicious message subject when you can use many?
2021-09-09/a>	Johannes Ullrich	Updates to Our Datafeeds/API
2021-09-07/a>	Johannes Ullrich	Why I Gave Up on IPv6. And no, it is not because of security issues.
2021-09-02/a>	Xavier Mertens	Attackers Will Always Abuse Major Events in our Lifes
2021-08-24/a>	Johannes Ullrich	Attackers Hunting For Twilio Credentials
2021-08-21/a>	Didier Stevens	New Versions Of Sysinternals Tools
2021-08-19/a>	Johannes Ullrich	When Lightning Strikes. What works and doesn't work.
2021-08-13/a>	Guy Bruneau	Scanning for Microsoft Exchange eDiscovery
2021-08-04/a>	Yee Ching Tok	Pivoting and Hunting for Shenanigans from a Reported Phishing Domain
2021-08-03/a>	Johannes Ullrich	Is this the Weirdest Phishing (SMishing?) Attempt Ever?
2021-08-01/a>	Didier Stevens	procdump Version 10.1
2021-07-31/a>	Guy Bruneau	Unsolicited DNS Queries
2021-07-28/a>	Jan Kopriva	A sextortion e-mail from...IT support?!
2021-07-24/a>	Bojan Zdrnja	Active Directory Certificate Services (ADCS - PKI) domain admin vulnerability
2021-07-21/a>	Johannes Ullrich	"Summer of SAM": Microsoft Releases Guidance for CVE-2021-36934
2021-07-19/a>	Rick Wanner	New Windows Print Spooler Vulnerability - CVE-2021-34481
2021-07-16/a>	Xavier Mertens	Multiple BaseXX Obfuscations
2021-07-14/a>	Jan Kopriva	One way to fail at malspam - give recipients the wrong password for an encrypted attachment
2021-07-13/a>	Johannes Ullrich	USPS Phishing Using Telegram to Collect Data
2021-07-10/a>	Guy Bruneau	Scanning for Microsoft Secure Socket Tunneling Protocol
2021-07-08/a>	Xavier Mertens	Using Sudo with Python For More Security Controls
2021-07-06/a>	Xavier Mertens	Python DLL Injection Check
2021-07-03/a>	Didier Stevens	Finding Strings With oledump.py
2021-07-02/a>	Xavier Mertens	"inception.py"... Multiple Base64 Encodings
2021-06-30/a>	Johannes Ullrich	CVE-2021-1675: Incomplete Patch and Leaked RCE Exploit
2021-06-28/a>	Didier Stevens	CFBF Files Strings Analysis
2021-06-26/a>	Guy Bruneau	CVE-2019-9670: Zimbra Collaboration Suite XXE vulnerability
2021-06-22/a>	Jan Kopriva	Phishing asking recipients not to report abuse
2021-06-18/a>	Daniel Wesemann	Network Forensics on Azure VMs (Part #2)
2021-06-18/a>	Daniel Wesemann	Open redirects ... and why Phishers love them
2021-06-15/a>	Johannes Ullrich	Multi Perimeter Device Exploit Mirai Version Hunting For Sonicwall, DLink, Cisco and more
2021-06-12/a>	Guy Bruneau	Fortinet Targeted for Unpatched SSL VPN Discovery Activity
2021-05-30/a>	Didier Stevens	Sysinternals: Procmon, Sysmon, TcpView and Process Explorer update
2021-05-29/a>	Guy Bruneau	Spear-phishing Email Targeting Outlook Mail Clients
2021-05-27/a>	Jan Kopriva	All your Base are...nearly equal when it comes to AV evasion, but 64-bit executables are not
2021-05-22/a>	Xavier Mertens	"Serverless" Phishing Campaign
2021-05-21/a>	Xavier Mertens	Locking Kernel32.dll As Anti-Debugging Technique
2021-05-14/a>	Xavier Mertens	"Open" Access to Industrial Systems Interface is Also Far From Zero
2021-05-12/a>	Jan Kopriva	Number of industrial control systems on the internet is lower then in 2020...but still far from zero
2021-05-10/a>	Johannes Ullrich	Correctly Validating IP Addresses: Why encoding matters for input validation.
2021-05-08/a>	Guy Bruneau	Who is Probing the Internet for Research Purposes?
2021-05-07/a>	Daniel Wesemann	Exposed Azure Storage Containers
2021-05-06/a>	Xavier Mertens	Alternative Ways To Perform Basic Tasks
2021-05-02/a>	Didier Stevens	PuTTY And FileZilla Use The Same Fingerprint Registry Keys
2021-04-30/a>	Remco Verhoef	Qiling: A true instrumentable binary emulation framework
2021-04-29/a>	Xavier Mertens	From Python to .Net
2021-04-24/a>	Guy Bruneau	Base64 Hashes Used in Web Scanning
2021-04-23/a>	Xavier Mertens	Malicious PowerPoint Add-On: "Small Is Beautiful"
2021-04-22/a>	Xavier Mertens	How Safe Are Your Docker Images?
2021-04-19/a>	Jan Kopriva	Hunting phishing websites with favicon hashes
2021-04-09/a>	Xavier Mertens	No Python Interpreter? This Simple RAT Installs Its Own Copy
2021-04-06/a>	Jan Kopriva	Malspam with Lokibot vs. Outlook and RFCs
2021-03-31/a>	Xavier Mertens	Quick Analysis of a Modular InfoStealer
2021-03-19/a>	Xavier Mertens	Pastebin.com Used As a Simple C2 Channel
2021-03-17/a>	Xavier Mertens	Defenders, Know Your Operating System Like Attackers Do!
2021-03-12/a>	Guy Bruneau	Microsoft DHCP Logs Shipped to ELK
2021-03-11/a>	Johannes Ullrich	Piktochart - Phishing with Infographics
2021-03-06/a>	Xavier Mertens	Spotting the Red Team on VirusTotal!
2021-03-04/a>	Xavier Mertens	From VBS, PowerShell, C Sharp, Process Hollowing to RAT
2021-02-26/a>	Guy Bruneau	Pretending to be an Outlook Version Update
2021-02-25/a>	Daniel Wesemann	Forensicating Azure VMs
2021-02-17/a>	Xavier Mertens	The new "LinkedInSecureMessage" ?
2021-02-13/a>	Guy Bruneau	vSphere Replication updates address a command injection vulnerability (CVE-2021-21976) - https://www.vmware.com/security/advisories/VMSA-2021-0001.html
2021-02-13/a>	Guy Bruneau	Using Logstash to Parse IPtables Firewall Logs
2021-02-10/a>	Brad Duncan	Phishing message to the ISC handlers email distro
2021-01-30/a>	Guy Bruneau	PacketSifter as Network Parsing and Telemetry Tool
2021-01-19/a>	Russ McRee	Gordon for fast cyber reputation checks
2021-01-17/a>	Didier Stevens	New Release of Sysmon Adding Detection for Process Tampering
2021-01-15/a>	Guy Bruneau	Obfuscated DNS Queries
2021-01-10/a>	Didier Stevens	Maldoc Analysis With CyberChef
2021-01-09/a>	Didier Stevens	Maldoc Strings Analysis
2021-01-02/a>	Guy Bruneau	Protecting Home Office and Enterprise in 2021
2021-01-01/a>	Didier Stevens	Strings 2021
2020-12-29/a>	Jan Kopriva	Want to know what's in a folder you don't have a permission to access? Try asking your AV solution...
2020-12-26/a>	Didier Stevens	base64dump.py Supported Encodings
2020-12-14/a>	Johannes Ullrich	SolarWinds Breach Used to Infiltrate Customer Networks (Solarigate)
2020-12-13/a>	Didier Stevens	KringleCon 2020
2020-12-08/a>	Johannes Ullrich	December 2020 Microsoft Patch Tuesday: Exchange, Sharepoint, Dynamics and DNS Spoofing
2020-12-06/a>	Didier Stevens	oledump's Indicators (video)
2020-12-05/a>	Guy Bruneau	Is IP 91.199.118.137 testing Access to aahwwx.52host.xyz?
2020-12-04/a>	Guy Bruneau	Detecting Actors Activity with Threat Intel
2020-11-19/a>	Xavier Mertens	PowerShell Dropper Delivering Formbook
2020-11-07/a>	Guy Bruneau	Cryptojacking Targeting WebLogic TCP/7001
2020-11-05/a>	Xavier Mertens	Did You Spot "Invoke-Expression"?
2020-10-25/a>	Didier Stevens	Video: Pascal Strings
2020-10-24/a>	Guy Bruneau	An Alternative to Shodan, Censys with User-Agent CensysInspect/1.1
2020-10-22/a>	Jan Kopriva	BazarLoader phishing lures: plan a Halloween party, get a bonus and be fired in the same afternoon
2020-10-11/a>	Didier Stevens	Analyzing MSG Files With plugin_msg_summary
2020-10-09/a>	Jan Kopriva	Phishing kits as far as the eye can see
2020-10-03/a>	Guy Bruneau	Scanning for SOHO Routers
2020-10-02/a>	Xavier Mertens	Analysis of a Phishing Kit
2020-09-30/a>	Johannes Ullrich	Scans for FPURL.xml: Reconnaissance or Not?
2020-09-24/a>	Xavier Mertens	Party in Ibiza with PowerShell
2020-09-21/a>	Jan Kopriva	Slightly broken overlay phishing
2020-09-20/a>	Guy Bruneau	Analysis of a Salesforce Phishing Emails
2020-09-17/a>	Xavier Mertens	Suspicious Endpoint Containment with OSSEC
2020-09-02/a>	Xavier Mertens	Python and Risky Windows API Calls
2020-09-01/a>	Johannes Ullrich	Exposed Windows Domain Controllers Used in CLDAP DDoS Attacks
2020-08-30/a>	Johannes Ullrich	CenturyLink Outage Causing Internet Wide Problems
2020-08-28/a>	Xavier Mertens	Example of Malicious DLL Injected in PowerShell
2020-08-25/a>	Xavier Mertens	Keep An Eye on LOLBins
2020-08-24/a>	Xavier Mertens	Tracking A Malware Campaign Through VT
2020-08-22/a>	Guy Bruneau	Remote Desktop (TCP/3389) and Telnet (TCP/23), What might they have in Common?
2020-08-20/a>	Rob VandenBrink	Office 365 Mail Forwarding Rules (and other Mail Rules too)
2020-08-10/a>	Bojan Zdrnja	Scoping web application and web service penetration tests
2020-08-08/a>	Guy Bruneau	Scanning Activity Include Netcat Listener
2020-08-03/a>	Johannes Ullrich	A Word of Caution: Helping Out People Being Stalked Online
2020-07-30/a>	Johannes Ullrich	Python Developers: Prepare!!!
2020-07-28/a>	Johannes Ullrich	All I want this Tuesday: More Data
2020-07-27/a>	Johannes Ullrich	In Memory of Donald Smith
2020-07-26/a>	Didier Stevens	Cracking Maldoc VBA Project Passwords
2020-07-20/a>	Rick Wanner	Sextortion Update: The Final Final Chapter
2020-07-19/a>	Guy Bruneau	Scanning Activity for ZeroShell Unauthenticated Access
2020-07-12/a>	Didier Stevens	Maldoc: VBA Purging Example
2020-07-11/a>	Guy Bruneau	Scanning Home Internet Facing Devices to Exploit
2020-07-08/a>	Xavier Mertens	If You Want Something Done Right, You Have To Do It Yourself... Malware Too!
2020-07-04/a>	Russ McRee	Happy FouRth of July from the Internet Storm Center
2020-06-29/a>	Didier Stevens	Sysmon and Alternate Data Streams
2020-06-25/a>	Johannes Ullrich	Tech Tuesday Recap / Recordings: Part 2 (Installing the Honeypot) release.
2020-06-24/a>	Jan Kopriva	Using Shell Links as zero-touch downloaders and to initiate network connections
2020-06-18/a>	Jan Kopriva	Broken phishing accidentally exploiting Outlook zero-day
2020-06-16/a>	Xavier Mertens	Sextortion to The Next Level
2020-06-15/a>	Rick Wanner	HTML based Phishing Run
2020-06-13/a>	Guy Bruneau	Mirai Botnet Activity
2020-06-11/a>	Xavier Mertens	Anti-Debugging JavaScript Techniques
2020-06-08/a>	Didier Stevens	Translating BASE64 Obfuscated Scripts
2020-06-04/a>	Xavier Mertens	Anti-Debugging Technique based on Memory Protection
2020-06-01/a>	Jim Clausing	Stackstrings, type 2
2020-05-27/a>	Jan Kopriva	Frankenstein's phishing using Google Cloud Storage
2020-05-23/a>	Xavier Mertens	AgentTesla Delivered via a Malicious PowerPoint Add-In
2020-05-22/a>	Didier Stevens	Some Strings to Remember
2020-05-21/a>	Xavier Mertens	Malware Triage with FLOSS: API Calls Based Behavior
2020-05-16/a>	Guy Bruneau	Scanning for Outlook Web Access (OWA) & Microsoft Exchange Control Panel (ECP)
2020-05-14/a>	Rob VandenBrink	Patch Tuesday Revisited - CVE-2020-1048 isn't as "Medium" as MS Would Have You Believe
2020-05-04/a>	Didier Stevens	Sysmon and File Deletion
2020-05-02/a>	Guy Bruneau	Phishing PDF with Unusual Hostname
2020-04-29/a>	Johannes Ullrich	Privacy Preserving Protocols to Trace Covid19 Exposure
2020-04-28/a>	Jan Kopriva	Agent Tesla delivered by the same phishing campaign for over a year
2020-04-27/a>	Xavier Mertens	Powershell Payload Stored in a PSCredential Object
2020-04-18/a>	Guy Bruneau	Maldoc Falsely Represented as DOCX Invoice Redirecting to Fake Apple Store
2020-04-16/a>	Johannes Ullrich	Using AppLocker to Prevent Living off the Land Attacks
2020-04-13/a>	Jan Kopriva	Look at the same phishing campaign 3 months apart
2020-04-07/a>	Johannes Ullrich	Increase in RDP Scanning
2020-04-03/a>	Xavier Mertens	Obfuscated with a Simple 0x0A
2020-03-30/a>	Jan Kopriva	Crashing explorer.exe with(out) a click
2020-03-28/a>	Didier Stevens	Covid19 Domain Classifier
2020-03-27/a>	Johannes Ullrich	Help us classify Covid19 related domains https://isc.sans.edu/covidclassifier.html (login required)
2020-03-23/a>	Didier Stevens	Windows Zeroday Actively Exploited: Type 1 Font Parsing Remote Code Execution Vulnerability
2020-03-21/a>	Guy Bruneau	Honeypot - Scanning and Targeting Devices & Services
2020-03-16/a>	Jan Kopriva	Desktop.ini as a post-exploitation tool
2020-03-15/a>	Guy Bruneau	VPN Access and Activity Monitoring
2020-03-14/a>	Didier Stevens	Phishing PDF With Incremental Updates.
2020-03-13/a>	Rob VandenBrink	Not all Ethernet NICs are Created Equal - Trying to Capture Invalid Ethernet Frames
2020-03-05/a>	Xavier Mertens	Will You Put Your Password in a Survey?
2020-02-29/a>	Guy Bruneau	Hazelcast IMDG Discover Scan
2020-02-18/a>	Jan Kopriva	Discovering contents of folders in Windows without permissions
2020-02-17/a>	Didier Stevens	curl and SSPI
2020-02-16/a>	Guy Bruneau	SOAR or not to SOAR?
2020-02-15/a>	Didier Stevens	bsdtar on Windows 10
2020-02-10/a>	Jan Kopriva	Current PayPal phishing campaign or "give me all your personal information"
2020-02-03/a>	Jan Kopriva	Analysis of a triple-encrypted AZORult downloader
2020-02-02/a>	Didier Stevens	Video: Stego & Cryptominers
2020-01-27/a>	Johannes Ullrich	Network Security Perspective on Coronavirus Preparedness
2020-01-25/a>	Guy Bruneau	Is Threat Hunting the new Fad?
2020-01-24/a>	Xavier Mertens	Why Phishing Remains So Popular?
2020-01-21/a>	Russ McRee	DeepBlueCLI: Powershell Threat Hunting
2020-01-16/a>	Jan Kopriva	Picks of 2019 malware - the large, the small and the one full of null bytes
2020-01-09/a>	Kevin Shortt	Windows 7 - End of Life
2020-01-04/a>	Didier Stevens	KringleCon 2019
2019-12-26/a>	Xavier Mertens	Bypassing UAC to Install a Cryptominer
2019-12-22/a>	Didier Stevens	Extracting VBA Macros From .DWG Files
2019-12-16/a>	Didier Stevens	Malicious .DWG Files?
2019-12-13/a>	Jan Kopriva	Internet banking sites and their use of TLS... and SSLv3... and SSLv2?!
2019-12-06/a>	Jan Kopriva	Phishing with a self-contained credentials-stealing webpage
2019-12-05/a>	Jan Kopriva	E-mail from Agent Tesla
2019-12-04/a>	Jan Kopriva	Analysis of a strangely poetic malware
2019-11-27/a>	Brad Duncan	Finding an Agent Tesla malware sample
2019-11-26/a>	Jan Kopriva	Lessons learned from playing a willing phish
2019-11-25/a>	Xavier Mertens	My Little DoH Setup
2019-11-23/a>	Guy Bruneau	Local Malware Analysis with Malice
2019-11-11/a>	Johannes Ullrich	Are We Going Back to TheMoon (and How is Liquor Involved)?
2019-11-03/a>	Didier Stevens	You Too? "Unusual Activity with Double Base64 Encoding"
2019-10-31/a>	Jan Kopriva	EML attachments in O365 - a recipe for phishing
2019-10-30/a>	Xavier Mertens	Keep an Eye on Remote Access to Mailboxes
2019-10-27/a>	Guy Bruneau	Unusual Activity with Double Base64 Encoding
2019-10-24/a>	Johannes Ullrich	Your Supply Chain Doesn't End At Receiving: How Do You Decommission Network Equipment?
2019-10-20/a>	Guy Bruneau	Scanning Activity for NVMS-9000 Digital Video Recorder
2019-10-17/a>	Jan Kopriva	Phishing e-mail spoofing SPF-enabled domain
2019-10-16/a>	Xavier Mertens	Security Monitoring: At Network or Host Level?
2019-10-10/a>	Rob VandenBrink	Mining Live Networks for OUI Data Oddness
2019-10-09/a>	Brad Duncan	What data does Vidar malware steal from an infected host?
2019-09-27/a>	Xavier Mertens	New Scans for Polycom Autoconfiguration Files
2019-09-19/a>	Xavier Mertens	Blocklisting or Whitelisting in the Right Way
2019-09-07/a>	Guy Bruneau	Unidentified Scanning Activity
2019-08-25/a>	Guy Bruneau	Are there any Advantages of Buying Cyber Security Insurance?
2019-08-15/a>	Didier Stevens	Analysis of a Spearphishing Maldoc
2019-08-09/a>	Xavier Mertens	100% JavaScript Phishing Page
2019-08-08/a>	Johannes Ullrich	[Guest Diary] The good, the bad and the non-functional, or "how not to do an attack campaign"
2019-07-25/a>	Rob VandenBrink	When Users Attack! Users (and Admins) Thwarting Security Controls
2019-07-17/a>	Xavier Mertens	Analyzis of DNS TXT Records
2019-07-13/a>	Guy Bruneau	Guidance to Protect DNS Against Hijacking & Scanning for Version.BIND Still a Thing
2019-07-08/a>	Didier Stevens	Machine Code? No!
2019-07-07/a>	Rick Wanner	OpSec and OSInt
2019-07-04/a>	Didier Stevens	Machine Code?
2019-07-02/a>	Xavier Mertens	Malicious Script With Multiple Payloads
2019-06-27/a>	Rob VandenBrink	Finding the Gold in a Pile of Pennies - Long Tail Analysis in PowerShell
2019-06-20/a>	Xavier Mertens	Using a Travel Packing App for Infosec Purpose
2019-06-18/a>	Johannes Ullrich	What You Need To Know About TCP "SACK Panic"
2019-06-14/a>	Jim Clausing	A few Ghidra tips for IDA users, part 4 - function call graphs
2019-06-06/a>	Xavier Mertens	Keep an Eye on Your WMI Logs
2019-05-22/a>	Johannes Ullrich	An Update on the Microsoft Windows RDP "Bluekeep" Vulnerability (CVE-2019-0708) [now with pcaps]
2019-05-20/a>	Tom Webb	CVE-2019-0604 Attack
2019-05-13/a>	Xavier Mertens	From Phishing To Ransomware?
2019-05-06/a>	Didier Stevens	Text and Text
2019-05-03/a>	Jim Clausing	A few Ghidra tips for IDA users, part 3 - conversion, labels, and comments
2019-04-24/a>	Rob VandenBrink	Where have all the Domain Admins gone? Rooting out Unwanted Domain Administrators
2019-04-17/a>	Jim Clausing	A few Ghidra tips for IDA users, part 2 - strings and parameters
2019-04-17/a>	Xavier Mertens	Malware Sample Delivered Through UDF Image
2019-04-08/a>	Jim Clausing	A few Ghidra tips for IDA users, part 1 - the decompiler/unreachable code
2019-04-03/a>	Jim Clausing	A few Ghidra tips for IDA users, part 0 - automatic comments for API call parameters
2019-04-02/a>	Johannes Ullrich	Fake AV is Back: LaCie Network Drives Used to Spread Malware
2019-03-27/a>	Xavier Mertens	Running your Own Passive DNS Service
2019-03-21/a>	Xavier Mertens	New Wave of Extortion Emails: Central Intelligence Agency Case
2019-03-05/a>	Rob VandenBrink	Powershell, Active Directory and the Windows Host Firewall
2019-02-28/a>	Tom Webb	Phishing impersonations
2019-02-07/a>	Xavier Mertens	Phishing Kit with JavaScript Keylogger
2019-02-03/a>	Didier Stevens	Video: Analyzing a Simple HTML Phishing Attachment
2019-02-01/a>	Rick Wanner	Sextortion: Follow the Money Part 3 - The cashout begins!
2019-01-31/a>	Xavier Mertens	Tracking Unexpected DNS Changes
2019-01-30/a>	Russ McRee	CR19-010: The United States vs. Huawei
2019-01-29/a>	Johannes Ullrich	A Not So Well Done Phish (Why Attackers need to Implement IPv6 Now! ;-) )
2019-01-24/a>	Brad Duncan	Malspam with Word docs uses macro to run Powershell script and steal system data
2019-01-18/a>	John Bambenek	Sextortion Bitcoin on the Move
2019-01-14/a>	Rob VandenBrink	Still Running Windows 7? Time to think about that upgrade project!
2019-01-10/a>	Brad Duncan	Heartbreaking Emails: "Love You" Malspam
2019-01-02/a>	Lorna Hutcheson	Gift Card Scams on the rise
2019-01-02/a>	Xavier Mertens	Malicious Script Leaking Data via FTP
2018-12-27/a>	Didier Stevens	Matryoshka Phish
2018-12-26/a>	Didier Stevens	Bitcoin "Blocklists"
2018-12-23/a>	Guy Bruneau	Scanning Activity, end Goal is to add Hosts to Mirai Botnet
2018-12-22/a>	Didier Stevens	KringleCon 2018
2018-12-21/a>	Lorna Hutcheson	Phishing Attempts That Bypass 2FA
2018-12-19/a>	Xavier Mertens	Restricting PowerShell Capabilities with NetSh
2018-12-19/a>	Xavier Mertens	Microsoft OOB Patch for Internet Explorer: Scripting Engine Memory Corruption Vulnerability
2018-12-16/a>	Guy Bruneau	Random Port Scan for Open RDP Backdoor
2018-12-13/a>	Xavier Mertens	Phishing Attack Through Non-Delivery Notification
2018-12-09/a>	Didier Stevens	Quickie: String Analysis is Still Useful
2018-11-30/a>	Remco Verhoef	CoinMiners searching for hosts
2018-11-22/a>	Xavier Mertens	Divided Payload in Multiple Pasties
2018-11-20/a>	Xavier Mertens	Querying DShield from Cortex
2018-11-18/a>	Guy Bruneau	Multipurpose PCAP Analysis Tool
2018-11-17/a>	Xavier Mertens	Quickly Investigating Websites with Lookyloo
2018-11-15/a>	Brad Duncan	Emotet infection with IcedID banking Trojan
2018-11-14/a>	Brad Duncan	Day in the life of a researcher: Finding a wave of Trickbot malspam
2018-11-12/a>	Rick Wanner	Using the Neutrino ip-blocklist API to test general badness of an IP
2018-11-11/a>	Pasquale Stirparo	Community contribution: joining forces or multiply solutions?
2018-10-26/a>	Xavier Mertens	Dissecting Malicious Office Documents with Linux
2018-10-17/a>	Russ McRee	RedHunt Linux - Adversary Emulation, Threat Hunting & Intelligence
2018-09-28/a>	Xavier Mertens	More Excel DDE Code Injection
2018-09-20/a>	Xavier Mertens	Hunting for Suspicious Processes with OSSEC
2018-09-13/a>	Xavier Mertens	Malware Delivered Through MHT Files
2018-09-07/a>	Xavier Mertens	Crypto Mining in a Windows Headless Browser
2018-09-05/a>	Rob VandenBrink	Where have all my Certificates gone? (And when do they expire?)
2018-09-05/a>	Xavier Mertens	Malicious PowerShell Compiling C# Code on the Fly
2018-08-30/a>	Xavier Mertens	Crypto Mining Is More Popular Than Ever!
2018-08-29/a>	Xavier Mertens	3D Printers in The Wild, What Can Go Wrong?
2018-08-26/a>	Didier Stevens	Identifying numeric obfuscation
2018-08-23/a>	Xavier Mertens	Simple Phishing Through formcrafts.com
2018-08-12/a>	Didier Stevens	A URL shortener handy for phishers
2018-08-10/a>	Remco Verhoef	Hunting SSL/TLS clients using JA3
2018-08-06/a>	Didier Stevens	Numeric obfuscation: another example
2018-08-05/a>	Didier Stevens	Video: Maldoc analysis with standard Linux tools
2018-08-04/a>	Didier Stevens	Dealing with numeric obfuscation in malicious scripts
2018-07-30/a>	Xavier Mertens	Exploiting the Power of Curl
2018-07-29/a>	Guy Bruneau	Using RITA for Threat Analysis
2018-07-21/a>	Didier Stevens	BTC pickpockets are back
2018-07-17/a>	Xavier Mertens	Searching for Geographically Improbable Login Attempts
2018-07-15/a>	Didier Stevens	Video: Retrieving and processing JSON data (BTC example)
2018-07-15/a>	Didier Stevens	Extracting BTC addresses from emails
2018-07-14/a>	Didier Stevens	Retrieving and processing JSON data (BTC example)
2018-07-13/a>	Xavier Mertens	Cryptominer Delivered Though Compromized JavaScript File
2018-07-03/a>	Didier Stevens	Progress indication for scripts on Windows
2018-07-02/a>	Guy Bruneau	Hello Peppa! - PHP Scans
2018-07-01/a>	Didier Stevens	Video: Analyzing XPS Files
2018-06-30/a>	Didier Stevens	XPS samples
2018-06-26/a>	Didier Stevens	Analyzing XPS files
2018-06-22/a>	Lorna Hutcheson	XPS Attachment Used for Phishing
2018-06-21/a>	Xavier Mertens	Are Your Hunting Rules Still Working?
2018-06-19/a>	Xavier Mertens	PowerShell: ScriptBlock Logging... Or Not?
2018-06-13/a>	Xavier Mertens	A Bunch of Compromized Wordpress Sites
2018-06-07/a>	Remco Verhoef	Automated twitter loot collection
2018-06-05/a>	Xavier Mertens	Malicious Post-Exploitation Batch File
2018-05-24/a>	Xavier Mertens	"Blocked" Does Not Mean "Forget It"
2018-05-22/a>	Xavier Mertens	Malware Distributed via .slk Files
2018-05-09/a>	Xavier Mertens	Nice Phishing Sample Delivering Trickbot
2018-05-07/a>	Xavier Mertens	Adding Persistence Via Scheduled Tasks
2018-05-03/a>	Renato Marinho	WebLogic Exploited in the Wild (Again)
2018-05-02/a>	Russ McRee	Windows Commands Reference - An InfoSec Must Have
2018-03-12/a>	Xavier Mertens	Payload delivery via SMB
2018-03-05/a>	Xavier Mertens	Malicious Bash Script with Multiple Features
2018-03-04/a>	Xavier Mertens	The Crypto Miners Fight For CPU Cycles
2018-03-02/a>	Xavier Mertens	Common Patterns Used in Phishing Campaigns Files
2018-02-25/a>	Guy Bruneau	Blackhole Advertising Sites with Pi-hole
2018-02-01/a>	Xavier Mertens	Adaptive Phishing Kit
2018-01-31/a>	Tom Webb	Tax Phishing Time
2018-01-25/a>	Xavier Mertens	Ransomware as a Service
2018-01-20/a>	Didier Stevens	An RTF phish
2018-01-13/a>	Rick Wanner	Flaw in Intel's Active Management Technology (AMT)
2018-01-11/a>	Xavier Mertens	Mining or Nothing!
2018-01-07/a>	Guy Bruneau	SSH Scans by Clients Types
2018-01-03/a>	John Bambenek	Phishing to Rural America Leads to Six-figure Wire Fraud Losses
2018-01-02/a>	Didier Stevens	PDF documents & URLs: video
2018-01-01/a>	Didier Stevens	What is new?
2017-12-27/a>	Guy Bruneau	What are your Security Challenges for 2018?
2017-12-19/a>	Xavier Mertens	Example of 'MouseOver' Link in a Powerpoint File
2017-12-14/a>	Russ McRee	Security Planner: Improve your online safety
2017-12-13/a>	Xavier Mertens	Tracking Newly Registered Domains
2017-12-05/a>	Tom Webb	IR using the Hive Project.
2017-12-02/a>	Xavier Mertens	Using Bad Material for the Good
2017-12-01/a>	Xavier Mertens	Phishing Kit (Ab)Using Cloud Services
2017-11-29/a>	Xavier Mertens	Fileless Malicious PowerShell Sample
2017-11-25/a>	Guy Bruneau	Benefits associated with the use of Open Source Software
2017-11-23/a>	Xavier Mertens	Proactive Malicious Domain Search
2017-11-17/a>	Xavier Mertens	Top-100 Malicious IP STIX Feed
2017-11-16/a>	Xavier Mertens	Suspicious Domains Tracking Dashboard
2017-11-15/a>	Xavier Mertens	If you want something done right, do it yourself!
2017-11-13/a>	Guy Bruneau	jsonrpc Scanning for root account
2017-11-13/a>	Guy Bruneau	VBE Embeded Script (info.zip)
2017-11-11/a>	Xavier Mertens	Keep An Eye on your Root Certificates
2017-11-10/a>	Bojan Zdrnja	Battling e-mail phishing
2017-11-05/a>	Didier Stevens	Extracting the text from PDF documents
2017-11-04/a>	Didier Stevens	PDF documents & URLs
2017-11-01/a>	Rob VandenBrink	Securing SSH Services - Go Blue Team!!
2017-10-18/a>	Renato Marinho	Baselining Servers to Detect Outliers
2017-10-06/a>	Johannes Ullrich	What's in a cable? The dangers of unauthorized cables
2017-10-02/a>	Xavier Mertens	Investigating Security Incidents with Passive DNS
2017-09-30/a>	Lorna Hutcheson	Who's Borrowing your Resources?
2017-09-25/a>	Renato Marinho	XPCTRA Malware Steals Banking and Digital Wallet User's Credentials
2017-09-22/a>	Russell Eubanks	What is the State of Your Union?
2017-09-18/a>	Xavier Mertens	Getting some intelligence from malspam
2017-09-18/a>	Johannes Ullrich	SANS Securingthehuman posted a follow up to their Equifax breach webcast: https://securingthehuman.sans.org/blog/2017/09/15/equifax-webcast-follow-up
2017-09-17/a>	Guy Bruneau	rockNSM as a Incident Response Package
2017-09-13/a>	Rob VandenBrink	Sysinternals Update: Sysmon v6.10, Process Monitor v3.40, Autoruns v13.80, AccessChk v6.11 - https://blogs.technet.microsoft.com/sysinternals/2017/09/12/sysinternals-update-sysmon-v6-1-process-monitor-v3-4-autoruns-v13-8-accesschk-v6-11/
2017-09-11/a>	Russ McRee	Windows Auditing with WINspect
2017-09-06/a>	Adrien de Beaupre	Modern Web Application Penetration Testing , Hash Length Extension Attacks
2017-09-02/a>	Xavier Mertens	AutoIT based malware back in the wild
2017-08-24/a>	Bojan Zdrnja	Free Bitcoins? Why not?
2017-08-18/a>	Renato Marinho	EngineBox Malware Supports 10+ Brazilian Banks
2017-08-16/a>	Xavier Mertens	Analysis of a Paypal phishing kit
2017-08-15/a>	Brad Duncan	Malspam pushing Trickbot banking Trojan
2017-08-13/a>	Didier Stevens	The Good Phishing Email
2017-08-07/a>	Xavier Mertens	Increase of phpMyAdmin scans
2017-07-30/a>	Guy Bruneau	Text Banking Scams
2017-07-24/a>	Russell Eubanks	Trends Over Time
2017-07-16/a>	Renato Marinho	SMS Phishing induces victims to photograph its own token card
2017-07-12/a>	Xavier Mertens	Backup Scripts, the FIM of the Poor
2017-07-09/a>	Russ McRee	Adversary hunting with SOF-ELK
2017-07-05/a>	Didier Stevens	Selecting domains with random names
2017-06-27/a>	Brad Duncan	A Tale of Two Phishies
2017-06-17/a>	Guy Bruneau	Mapping Use Cases to Logs. Which Logs are the Most Important to Collect?
2017-06-15/a>	Bojan Zdrnja	Uberscammers
2017-06-14/a>	Xavier Mertens	Systemd Could Fallback to Google DNS?
2017-06-08/a>	Tom Webb	Summer STEM for Kids
2017-06-02/a>	Xavier Mertens	Phishing Campaigns Follow Trends
2017-06-01/a>	Xavier Mertens	Sharing Private Data with Webcast Invitations
2017-05-31/a>	Pasquale Stirparo	Analysis of Competing Hypotheses, WCry and Lazarus (ACH part 2)
2017-05-28/a>	Pasquale Stirparo	Analysis of Competing Hypotheses (ACH part 1)
2017-05-28/a>	Guy Bruneau	CyberChef a Must Have Tool in your Tool bag!
2017-05-20/a>	Xavier Mertens	Typosquatting: Awareness and Hunting
2017-05-13/a>	Guy Bruneau	Has anyone Tested WannaCry Killswitch? - https://blog.didierstevens.com/2017/05/13/quickpost-wcry-killswitch-check-is-not-proxy-aware/
2017-05-06/a>	Xavier Mertens	The story of the CFO and CEO...
2017-05-05/a>	Xavier Mertens	HTTP Headers... the Achilles' heel of many applications
2017-05-03/a>	Bojan Zdrnja	OAUTH phishing against Google Docs ? beware!
2017-04-22/a>	Jim Clausing	WTF tcp port 81
2017-04-20/a>	Xavier Mertens	DNS Query Length... Because Size Does Matter
2017-04-18/a>	Johannes Ullrich	Yet Another Apple Phish and Some DNS Lessons Learned From It
2017-04-16/a>	Johannes Ullrich	Tool to Detect Active Phishing Attacks Using Unicode Look-Alike Domains
2017-03-28/a>	Xavier Mertens	Logical & Physical Security Correlation
2017-03-24/a>	Xavier Mertens	Nicely Obfuscated JavaScript Sample
2017-03-15/a>	Xavier Mertens	Retro Hunting!
2017-03-06/a>	Renato Marinho	A very convincing Typosquatting + Social Engineering campaign is targeting Santander corporate customers in Brazil
2017-02-12/a>	Xavier Mertens	Analysis of a Suspicious Piece of JavaScript
2017-02-05/a>	Xavier Mertens	Many Malware Samples Found on Pastebin
2017-02-02/a>	Rick Wanner	Multiple vulnerabilities discovered in popular printer models
2017-02-01/a>	Xavier Mertens	Quick Analysis of Data Left Available by Attackers
2017-01-18/a>	Rob VandenBrink	Making Windows 10 a bit less "Creepy" - Common Privacy Settings
2017-01-12/a>	Mark Baggett	Some tools updates
2017-01-12/a>	Mark Baggett	System Resource Utilization Monitor
2017-01-11/a>	Johannes Ullrich	January 2017 Edition of Ouch! Security Awareness Newsletter Released: https://securingthehuman.sans.org/ouch
2017-01-10/a>	Johannes Ullrich	Realtors Be Aware: You Are a Target
2017-01-10/a>	Johannes Ullrich	Port 37777 "MapTable" Requests
2017-01-06/a>	John Bambenek	Great Misadventures of Security Vendors: Absurd Sandboxing Edition
2017-01-04/a>	John Bambenek	Mixed Messages : Novel Phishing Attempts Trying to Steal Your E-mail Password Goes Wrong
2016-11-23/a>	Tom Webb	Mapping Attack Methodology to Controls
2016-11-22/a>	Didier Stevens	Update:ZIP With Comment
2016-11-18/a>	Didier Stevens	VBA Shellcode and Windows 10
2016-11-16/a>	Xavier Mertens	Example of Getting Analysts & Researchers Away
2016-11-13/a>	Guy Bruneau	Bitcoin Miner File Upload via FTP
2016-11-11/a>	Rick Wanner	Benevolent malware? reincarna/Linux.Wifatch
2016-11-02/a>	Rob VandenBrink	What Does a Pentest Look Like?
2016-10-25/a>	Xavier Mertens	Another Day, Another Spam...
2016-10-10/a>	Didier Stevens	Radare2: rahash2
2016-10-08/a>	Russell Eubanks	Unauthorized Change Detected!
2016-10-02/a>	Guy Bruneau	Is there an Infosec Cybersecurity Talent Shortage?
2016-09-25/a>	Pasquale Stirparo	Defining Threat Intelligence Requirements
2016-09-04/a>	Russ McRee	Kali Linux 2016.2 Release: https://www.kali.org/news/kali-linux-20162-release/
2016-09-01/a>	Xavier Mertens	Maxmind.com (Ab)used As Anti-Analysis Technique
2016-08-29/a>	Russ McRee	Recommended Reading: Intrusion Detection Using Indicators of Compromise Based on Best Practices and Windows Event Logs
2016-08-24/a>	Tom Webb	Stay on Track During IR
2016-08-23/a>	Xavier Mertens	Voice Message Notifications Deliver Ransomware
2016-08-02/a>	Tom Webb	Windows 10 Anniversary Update Available
2016-07-31/a>	Pasquale Stirparo	Sharing (intel) is caring... or not?
2016-07-27/a>	Xavier Mertens	Analyze of a Linux botnet client source code
2016-07-21/a>	Didier Stevens	Practice ntds.dit File
2016-07-15/a>	Xavier Mertens	Name All the Things!
2016-07-12/a>	Xavier Mertens	Hunting for Malicious Files with MISP + OSSEC
2016-07-03/a>	Guy Bruneau	Is Data Privacy part of your Company's Culture?
2016-06-29/a>	Xavier Mertens	Phishing Campaign with Blurred Images
2016-06-12/a>	Guy Bruneau	DNS Sinkhole ISO Version 2.0
2016-06-03/a>	Tom Liston	MySQL is YourSQL
2016-06-01/a>	Xavier Mertens	Docker Containers Logging
2016-05-29/a>	Guy Bruneau	Analysis of a Distributed Denial of Service (DDoS)
2016-05-22/a>	Pasquale Stirparo	The strange case of WinZip MRU Registry key
2016-05-21/a>	Didier Stevens	Python Malware - Part 2
2016-05-18/a>	Russ McRee	Resources: Windows Auditing & Monitoring, Linux 2FA
2016-05-14/a>	Guy Bruneau	INetSim as a Basic Honeypot
2016-05-12/a>	Xavier Mertens	Another Day, Another Wave of Phishing Emails
2016-05-08/a>	Jim Clausing	Guest Diary: Linux Capabilities - A friend and foe
2016-05-05/a>	Xavier Mertens	Microsoft BITS Used to Download Payloads
2016-05-02/a>	Rick Wanner	Lean Threat Intelligence
2016-04-29/a>	Rob VandenBrink	Sysinternals Updated today - Updates to Sysmon, Procdump and Sigcheck. https://blogs.technet.microsoft.com/sysinternals/2016/04/28/update-sysmon-v4-procdump-v8-sigcheck-v2-51/
2016-04-15/a>	Xavier Mertens	Windows Command Line Persistence?
2016-04-02/a>	Russell Eubanks	Why Can't We Be Friends?
2016-03-30/a>	Xavier Mertens	What to watch with your FIM?
2016-03-28/a>	Xavier Mertens	Improving Bash Forensics Capabilities
2016-03-21/a>	Xavier Mertens	IP Addresses Triage
2016-02-24/a>	Xavier Mertens	Analyzis of a Malicious .lnk File with an Embedded Payload
2016-02-18/a>	Xavier Mertens	Hunting for Executable Code in Windows Environments
2016-02-15/a>	Bojan Zdrnja	Exploiting (pretty) blind SQL injections
2016-02-07/a>	Xavier Mertens	More Malicious JavaScript Obfuscation
2016-02-02/a>	Johannes Ullrich	Targeted IPv6 Scans Using pool.ntp.org .
2016-01-31/a>	Guy Bruneau	Windows 10 and System Protection for DATA Default is OFF
2016-01-23/a>	Didier Stevens	Sigcheck and VirusTotal for Offline Machine
2016-01-20/a>	Xavier Mertens	/tmp, %TEMP%, ~/Desktop, T:\, ... A goldmine for pentesters!
2016-01-13/a>	Alex Stanford	You Have Got a New Audio Message - Guest Diary by Pasquale Stirparo
2016-01-09/a>	Xavier Mertens	Virtual Bitlocker Containers
2015-12-24/a>	Xavier Mertens	Unity Makes Strength
2015-12-12/a>	Russell Eubanks	What Signs Are You Missing?
2015-12-10/a>	Rob VandenBrink	Uninstalling Problem Applications using Powershell
2015-12-10/a>	Rob VandenBrink	New Burp Feature - ClickBandit
2015-12-09/a>	Xavier Mertens	Enforcing USB Storage Policy with PowerShell
2015-12-04/a>	Tom Webb	Automating Phishing Analysis using BRO
2015-11-21/a>	Didier Stevens	Maldoc Social Engineering Trick
2015-11-09/a>	John Bambenek	ICYMI: Widespread Unserialize Vulnerability in Java
2015-10-20/a>	Bojan Zdrnja	When encoding saves the day
2015-10-12/a>	Guy Bruneau	Data Visualization,What is your Tool of Choice?
2015-09-29/a>	Pedro Bueno	Tricks for DLL analysis
2015-09-23/a>	Daniel Wesemann	Making our users unlearn what we taught them
2015-09-21/a>	Xavier Mertens	Detecting XCodeGhost Activity
2015-09-03/a>	Xavier Mertens	Querying the DShield API from RTIR
2015-08-19/a>	Bojan Zdrnja	Outsourcing critical infrastructure (such as DNS)
2015-08-18/a>	Russ McRee	Microsoft Security Bulletin MS15-093 - Critical OOB - Internet Explorer RCE
2015-08-16/a>	Guy Bruneau	Are you a "Hunter"?
2015-08-12/a>	Rob VandenBrink	Windows Service Accounts - Why They're Evil and Why Pentesters Love them!
2015-08-06/a>	Didier Stevens	Sigcheck and virustotal-search
2015-07-23/a>	Mark Hofman	Some more 0-days from ZDI
2015-07-21/a>	Didier Stevens	Searching Through the VirusTotal Database
2015-07-17/a>	Didier Stevens	Process Explorer and VirusTotal
2015-07-17/a>	Didier Stevens	Autoruns and VirusTotal
2015-07-17/a>	Didier Stevens	Sigcheck and VirusTotal
2015-07-03/a>	Didier Stevens	Analyzing Quarantine Files
2015-06-29/a>	Rob VandenBrink	The Powershell Diaries 2 - Software Inventory
2015-06-27/a>	Guy Bruneau	Is Windows XP still around in your Network a year after Support Ended?
2015-06-22/a>	Johannes Ullrich	SMTP Brute Forcing
2015-06-01/a>	Tom Webb	Submit Dshield ASA Logs
2015-05-30/a>	Russell Eubanks	Weekend Learning - Spoofer Project
2015-05-27/a>	Tom Webb	SYSINTERNALS Update(AccessChk v6.0, Autoruns v13.4, Process Monitor v3.2, VMMap v3.2)
2015-05-14/a>	Daniel Wesemann	Oh Bloat!
2015-04-27/a>	Richard Porter	When Prevention Fails, Incident Response Begins
2015-04-17/a>	Didier Stevens	Memory Forensics Of Network Devices
2015-04-10/a>	Didier Stevens	The Kill Chain: Now With Pastebin
2015-04-03/a>	Didier Stevens	SSH Fingerprints Are Important
2015-03-26/a>	Daniel Wesemann	Pin-up on your Smartphone!
2015-03-07/a>	Guy Bruneau	Should it be Mandatory to have an Independent Security Audit after a Breach?
2015-02-19/a>	Daniel Wesemann	DNS-based DDoS
2015-02-06/a>	Johannes Ullrich	Anthem, TurboTax and How Things "Fit Together" Sometimes
2015-02-04/a>	Alex Stanford	Exploit Kit Evolution - Neutrino
2015-01-31/a>	Guy Bruneau	Beware of Phishing and Spam Super Bowl Fans!
2015-01-29/a>	Bojan Zdrnja	Blindly confirming XXE
2015-01-23/a>	Adrien de Beaupre	Infocon change to yellow for Adobe Flash issues
2014-12-24/a>	Rick Wanner	Incident Response at Sony
2014-12-23/a>	John Bambenek	How I learned to stop worrying and love malware DGAs....
2014-11-27/a>	Russ McRee	Syrian Electronic Army attack leads to malvertising
2014-11-25/a>	Adrien de Beaupre	Less is, umm, less?
2014-09-27/a>	Guy Bruneau	What has Bash and Heartbleed Taught Us?
2014-09-26/a>	Richard Porter	Why We Have Moved to InfoCon:Yellow
2014-09-22/a>	Johannes Ullrich	Fake LogMeIn Certificate Update with Bad AV Detection Rate
2014-09-19/a>	Guy Bruneau	Web Scan looking for /info/whitelist.pac
2014-09-16/a>	Daniel Wesemann	https://yourfakebank.support -- TLD confusion starts!
2014-09-12/a>	Chris Mohan	Are credential dumps worth reviewing?
2014-09-07/a>	Johannes Ullrich	Odd Persistent Password Bruteforcing
2014-08-27/a>	Rob VandenBrink	One More Day of Trolling in POS Memory
2014-08-20/a>	Kevin Shortt	Social Engineering Alive and Well
2014-08-16/a>	Lenny Zeltser	Web Server Attack Investigation - Installing a Bot and Reverse Shell via a PHP Vulnerability
2014-08-15/a>	Tom Webb	AppLocker Event Logs with OSSEC 2.8
2014-08-12/a>	Adrien de Beaupre	Sysinternals updates Sysmon v1.0; Updates: Autoruns v12.01, Coreinfo v3.3, Procexp v16.03 http://blogs.technet.com/b/sysinternals/
2014-08-10/a>	Basil Alawi S.Taher	Incident Response with Triage-ir
2014-08-09/a>	Adrien de Beaupre	Complete application ownage via Multi-POST XSRF
2014-08-04/a>	Russ McRee	Threats & Indicators: A Security Intelligence Lifecycle
2014-07-30/a>	Rick Wanner	Symantec Endpoint Protection Privilege Escalation Zero Day
2014-07-26/a>	Chris Mohan	"Internet scanning project" scans
2014-07-23/a>	Johannes Ullrich	New Feature: "Live" SSH Brute Force Logs and New Kippo Client
2014-07-15/a>	Daniel Wesemann	Oracle July 2014 CPU (patch bundle)
2014-07-14/a>	Johannes Ullrich	The Internet of Things: How do you "on-board" devices?
2014-07-14/a>	Daniel Wesemann	E-ZPass phishing scam
2014-07-09/a>	Daniel Wesemann	Who owns your typo?
2014-07-07/a>	Johannes Ullrich	Multi Platform *Coin Miner Attacking Routers on Port 32764
2014-07-06/a>	Richard Porter	Physical Access, Point of Sale, Vegas
2014-07-05/a>	Guy Bruneau	Java Support ends for Windows XP
2014-07-02/a>	Johannes Ullrich	July Ouch! Security Awareness Newsletter Released. E-mail Do's and Don'ts http://www.securingthehuman.org/resources/newsletters/ouch/2014#july2014
2014-06-23/a>	Russ McRee	Microsoft Interflow announced today at 26th FIRST conference
2014-06-12/a>	Guy Bruneau	BIND Security Update for CVE-2014-3859
2014-06-12/a>	Daniel Wesemann	Made any new friends lately?
2014-05-23/a>	Richard Porter	Highlights from Cisco Live 2014 - The Internet of Everything
2014-05-22/a>	Johannes Ullrich	Discontinuing Support for ISC Alert Task Bar Icon
2014-05-01/a>	Johannes Ullrich	Busybox Honeypot Fingerprinting and a new DVR scanner
2014-04-26/a>	Guy Bruneau	Android Users - Beware of Bitcoin Mining Malware
2014-04-26/a>	Guy Bruneau	New Project by Linux Foundation - Core Infrastructure Initiative
2014-04-14/a>	Kevin Shortt	INFOCon Green: Heartbleed - on the mend
2014-04-11/a>	Guy Bruneau	Heartbleed Fix Available for Download for Cisco Products
2014-04-06/a>	Basil Alawi S.Taher	"Power Worm" PowerShell based Malware
2014-04-05/a>	Jim Clausing	Those strange e-mails with URLs in them can lead to Android malware
2014-04-04/a>	Rob VandenBrink	Windows 8.1 Released
2014-04-04/a>	Rob VandenBrink	Dealing with Disaster - A Short Malware Incident Response
2014-04-01/a>	Johannes Ullrich	cmd.so Synology Scanner Also Found on Routers
2014-03-27/a>	Alex Stanford	Apple Credential Phishing via appleidconfirm.net
2014-03-25/a>	Johannes Ullrich	A few updates on "The Moon" worm
2014-03-24/a>	Johannes Ullrich	New Microsoft Advisory: Unpatched Word Flaw used in Targeted Attacks
2014-03-22/a>	Guy Bruneau	How the Compromise of a User Account Lead to a Spam Incident
2014-03-12/a>	Johannes Ullrich	Wordpress "Pingback" DDoS Attacks
2014-03-10/a>	Basil Alawi S.Taher	Sysinternals Process Explorer v16.02, Process Monitor v3.1, PSExec v2.1 and Sigcheck v2.03 update
2014-03-07/a>	Tom Webb	Linux Memory Dump with Rekall
2014-03-04/a>	Daniel Wesemann	XPired!
2014-03-02/a>	Stephen Hall	Sunday Reading
2014-02-28/a>	Daniel Wesemann	Oversharing
2014-02-19/a>	Russ McRee	Threat modeling in the name of security
2014-02-18/a>	Johannes Ullrich	More Details About "TheMoon" Linksys Worm
2014-02-15/a>	Rob VandenBrink	More on HNAP - What is it, How to Use it, How to Find it
2014-02-13/a>	Johannes Ullrich	Linksys Worm ("TheMoon") Captured
2014-02-12/a>	Johannes Ullrich	Suspected Mass Exploit Against Linksys E1000 / E1200 Routers
2014-02-10/a>	Rob VandenBrink	Isn't it About Time to Get Moving on Chip and PIN?
2014-02-07/a>	Rob VandenBrink	Hello Virustotal? It's Microsoft Calling.
2014-02-04/a>	Johannes Ullrich	Odd ICMP Echo Request Payload
2014-01-30/a>	Johannes Ullrich	New gTLDs appearing in the root zone
2014-01-24/a>	Johannes Ullrich	How to send mass e-mail the right way
2014-01-24/a>	Chris Mohan	Phishing via Social Media
2014-01-23/a>	Chris Mohan	Learning from the breaches that happens to others Part 2
2014-01-22/a>	Chris Mohan	Learning from the breaches that happens to others
2014-01-11/a>	Guy Bruneau	tcpflow 1.4.4 and some of its most Interesting Features
2014-01-10/a>	Basil Alawi S.Taher	Windows Autorun-3
2014-01-10/a>	Basil Alawi S.Taher	Cisco Small Business Devices backdoor fix
2014-01-04/a>	Tom Webb	Monitoring Windows Networks Using Syslog (Part One)
2014-01-02/a>	John Bambenek	OpenSSL.org Defaced by Attackers Gaining Access to Hypervisor
2014-01-02/a>	Johannes Ullrich	Scans Increase for New Linksys Backdoor (32764/TCP)
2013-12-24/a>	Daniel Wesemann	Unfriendly crontab additions
2013-12-21/a>	Daniel Wesemann	Adobe phishing underway
2013-12-21/a>	Guy Bruneau	Strange DNS Queries - Request for Packets
2013-12-19/a>	Rob VandenBrink	Passive Scanning Two Ways - How-Tos for the Holidays
2013-12-19/a>	Rob VandenBrink	Target US - Credit Card Data Breach
2013-12-16/a>	Tom Webb	The case of Minerd
2013-12-11/a>	Johannes Ullrich	Facebook Phishing and Malware via Tumblr Redirects
2013-12-09/a>	Rob VandenBrink	Scanning without Scanning
2013-12-07/a>	Guy Bruneau	Suspected Active Rovnix Botnet Controller
2013-12-02/a>	Richard Porter	Reports of higher than normal SSH Attacks
2013-12-01/a>	Richard Porter	BPF, PCAP, Binary, hex, why they matter?
2013-11-30/a>	Russ McRee	A review of Tubes, A Journey to the Center of the Internet
2013-11-27/a>	Rob VandenBrink	ATM Traffic + TCPDump + Video = Good or Evil?
2013-11-19/a>	Johannes Ullrich	vBulletin.com Compromise - Possible 0-day
2013-11-18/a>	Johannes Ullrich	Am I Sending Traffic to a "Sinkhole"?
2013-11-15/a>	Johannes Ullrich	The Security Impact of HTTP Caching Headers
2013-11-11/a>	Johannes Ullrich	What Happened to the SANS Ads?
2013-11-04/a>	Manuel Humberto Santander Pelaez	When attackers use your DNS to check for the sites you are visiting
2013-11-01/a>	Russ McRee	Secunia's PSI Country Report - Q3 2013
2013-10-30/a>	Russ McRee	SIR v15: Five good reasons to leave Windows XP behind
2013-10-25/a>	Johannes Ullrich	PHP.net compromise aftermath: Why Code Signing Beats Hashes
2013-10-25/a>	Rob VandenBrink	Kaspersky flags TCPIP.SYS as Malware
2013-10-22/a>	Richard Porter	Greenbone and OpenVAS Scanner
2013-10-21/a>	Johannes Ullrich	New tricks that may bring DNS spoofing back or: "Why you should enable DNSSEC even if it is a pain to do"
2013-10-19/a>	Johannes Ullrich	Yet Another WHMCS SQL Injection Exploit
2013-10-17/a>	Adrien de Beaupre	Internet wide DNS scanning
2013-10-04/a>	Pedro Bueno	CSAM: WebHosting BruteForce logs
2013-10-01/a>	John Bambenek	*Metaspoit Releases Module to Exploit Unpatched IE Vuln CVE-2013-3893
2013-09-20/a>	Russ McRee	Threat Level Yellow: Protection recommendations regarding Internet Explorer exploits in the wild
2013-09-17/a>	John Bambenek	Microsoft Releases Out-of-Band Advisory for all Versions of Internet Explorer
2013-09-09/a>	Johannes Ullrich	SSL is broken. So what?
2013-09-05/a>	Rob VandenBrink	Building Your Own GPU Enabled Private Cloud
2013-09-02/a>	Guy Bruneau	Snort IDS Sensor with Sguil New ISO Released
2013-08-26/a>	Alex Stanford	Stop, Drop and File Carve
2013-08-22/a>	Russ McRee	Read of the Week: A Fuzzy Future in Malware Research
2013-08-19/a>	Johannes Ullrich	Running Snort on ESXi using the Distributed Switch
2013-08-19/a>	Rob VandenBrink	ZMAP 1.02 released
2013-08-14/a>	Johannes Ullrich	Imaging LUKS Encrypted Drives
2013-08-13/a>	Swa Frantzen	Microsoft security advisories: RDP and MD5 deprecation in Microsoft root certificates
2013-08-09/a>	Kevin Shortt	Copy Machines - Changing Scanned Content
2013-08-05/a>	Chris Mohan	DMARC: another step forward in the fight against phishing?
2013-07-31/a>	Johannes Ullrich	POP3 Server Brute Forcing Attempts Using Polycom Credentials
2013-07-26/a>	Scott Fendley	ISC BIND DoS
2013-07-20/a>	Manuel Humberto Santander Pelaez	Do you have rogue Internet gateways in your network? Check it with nmap
2013-07-19/a>	Stephen Hall	Cyber Intelligence Tsunami
2013-07-18/a>	Chris Mohan	Blog Spam - annoying junk or a source of intelligence?
2013-07-16/a>	Johannes Ullrich	Why don't we see more examples of web app attacks via POST?
2013-07-13/a>	Lenny Zeltser	Decoy Personas for Safeguarding Online Identity Using Deception
2013-07-08/a>	Richard Porter	Why do we Click?
2013-07-06/a>	Guy Bruneau	Is Metadata the Magic in Modern Network Security?
2013-07-01/a>	Manuel Humberto Santander Pelaez	Using nmap scripts to enhance vulnerability asessment results
2013-06-29/a>	Johannes Ullrich	Instagram "Fruit" Spam
2013-06-21/a>	Guy Bruneau	Sysinternals Updates for Autoruns, Strings & ZoomIt http://blogs.technet.com/b/sysinternals/archive/2013/06/20/updates-autoruns-v11-61-strings-v2-52-zoomit-v4-5.aspx
2013-06-20/a>	Johannes Ullrich	Linkedin DNS Hijack
2013-06-19/a>	Kevin Liston	WinLink Check-In
2013-06-05/a>	Richard Porter	Windows Sysinternals Updated http://technet.microsoft.com/en-us/sysinternals/default.aspx
2013-06-05/a>	Richard Porter	BIND 9 Update fixing CVE-2013-3919
2013-05-23/a>	Adrien de Beaupre	MoVP II
2013-05-21/a>	Adrien de Beaupre	Moore, Oklahoma tornado charitable organization scams, malware, and phishing
2013-05-20/a>	Guy Bruneau	Sysinternals Updates for Accesschk, Procdump, RAMMap and Strings http://blogs.technet.com/b/sysinternals/archive/2013/05/17/updates-accesschk-v5-11-procdump-v6-0-rammap-v1-22-strings-v2-51.aspx
2013-05-14/a>	Swa Frantzen	CVE-2013-2094: Linux privilege escalation
2013-05-09/a>	Johannes Ullrich	Microsoft released a Fix-it for the Internet Explorer 8 Vulnerability http://support.microsoft.com/kb/2847140
2013-05-08/a>	Chris Mohan	Syria drops from Internet 7th May 2013
2013-05-07/a>	Jim Clausing	NGINX updates address buffer overflow (CVE-2013-2028) see http://nginx.org/en/CHANGES-1.4
2013-05-07/a>	Jim Clausing	Is there an epidemic of typo squatting?
2013-05-04/a>	Kevin Shortt	The Zero-Day Pendulum Swings
2013-05-01/a>	Daniel Wesemann	The cost of cleaning up
2013-04-23/a>	Russ McRee	Microsoft's Security Intelligence Report (SIRv14) released
2013-04-16/a>	John Bambenek	Fake Boston Marathon Scams Update
2013-04-15/a>	Rob VandenBrink	Oops - You Mean That Deleted Server was a Certificate Authority?
2013-04-15/a>	John Bambenek	Please send any spam (full headers), URLs or other suspicious content scamming off Boston Marathon explosions to handlers@sans.org
2013-03-29/a>	Chris Mohan	Fake Link removal requests
2013-03-27/a>	Adam Swanger	IPv6 Focus Month: Guest Diary: Stephen Groat - IPv6 moving target defense
2013-03-19/a>	Johannes Ullrich	Windows 7 SP1 and Windows Server 2008 R2 SP1 Being "pushed" today
2013-03-19/a>	Johannes Ullrich	IPv6 Focus Month: The warm and fuzzy side of IPv6
2013-03-07/a>	Guy Bruneau	Apple Blocking Java Web plug-in
2013-03-06/a>	Adam Swanger	IPv6 Focus Month: Guest Diary: Stephen Groat - Geolocation Using IPv6 Addresses
2013-03-05/a>	Mark Hofman	IPv6 Focus Month: Device Defaults
2013-03-02/a>	Scott Fendley	Evernote Security Issue
2013-03-02/a>	Scott Fendley	Apple Blocks Older Insecure Versions of Flash Player
2013-02-28/a>	Daniel Wesemann	Parsing Windows Eventlogs in Powershell
2013-02-22/a>	Johannes Ullrich	Zendesk breach affects Tumblr/Pinterest/Twitter
2013-02-19/a>	Johannes Ullrich	APT1, Unit 61398 and are state sponsored attacks real
2013-02-17/a>	Guy Bruneau	HP ArcSight Connector Appliance and Logger Vulnerabilities
2013-02-11/a>	John Bambenek	Is This Chinese Registrar Really Trying to XSS Me?
2013-02-06/a>	Adam Swanger	Sysinternals in particular Process Explorer update https://blogs.technet.com/b/sysinternals/?Redirected=true
2013-02-06/a>	Johannes Ullrich	Are you losing system logging information (and don't know it)?
2013-02-06/a>	Johannes Ullrich	Intel Network Card (82574L) Packet of Death
2013-02-04/a>	Russ McRee	An expose of a recent SANS GIAC XSS vulnerability
2013-02-04/a>	Adam Swanger	SAN Securing The Human Monthly Awareness Video - Advanced Persistent Threat (APT) http://www.securingthehuman.org/resources/ncsam
2013-01-30/a>	Richard Porter	Getting Involved with the Local Community
2013-01-25/a>	Johannes Ullrich	Vulnerability Scans via Search Engines (Request for Logs)
2013-01-15/a>	Rob VandenBrink	When Disabling IE6 (or Java, or whatever) is not an Option...
2013-01-13/a>	Stephen Hall	Sysinternals Updates
2013-01-10/a>	Rob VandenBrink	What Else runs Telnets? Or, Pentesters Love Video Conferencing Units Too!
2013-01-09/a>	Rob VandenBrink	SQL Injection Flaw in Ruby on Rails
2013-01-05/a>	Guy Bruneau	D-link Wireless-G Router Year Issue (Y2K-plus-13)
2013-01-02/a>	Russ McRee	EMET 3.5: The Value of Looking Through an Attacker's Eyes
2013-01-01/a>	Johannes Ullrich	FixIt Available for Internet Explorer Vulnerability
2012-12-20/a>	Daniel Wesemann	White House strategy on security information sharing and safeguarding
2012-12-13/a>	Johannes Ullrich	What if Tomorrow Was the Day?
2012-12-06/a>	Daniel Wesemann	Fake tech support calls - revisited
2012-12-06/a>	Daniel Wesemann	Rich Quick Make Money!
2012-12-03/a>	John Bambenek	John McAfee Exposes His Location in Photo About His Being on Run
2012-12-02/a>	Guy Bruneau	Collecting Logs from Security Devices at Home
2012-11-30/a>	Daniel Wesemann	Nmap 6.25 released - lots of new goodies, see http://nmap.org/changelog.html
2012-11-29/a>	Kevin Shortt	New Apple Security Update: APPLE-SA-2012-11-29-1 Apple TV 5.1.1
2012-11-28/a>	Mark Hofman	McAfee releases extraDAT for W32/Autorun.worm.aaeb-h
2012-11-28/a>	Mark Hofman	New version of wireshark is available (1.8.4), some security fixes included.
2012-11-27/a>	Chris Mohan	Can users' phish emails be a security admin's catch of the day?
2012-11-26/a>	John Bambenek	Online Shopping for the Holidays? Tips, News and a Fair Warning
2012-11-20/a>	John Bambenek	Firefox v 17.0 just released, more here: http://www.mozilla.org/en-US/firefox/17.0/releasenotes/
2012-11-20/a>	John Bambenek	Behind the Random NTP Bizarreness of Incorrect Year Being Set
2012-11-19/a>	John Bambenek	MoneyGram fined $100 million for aiding wire fraud - http://krebsonsecurity.com/2012/11/moneygram-fined-100-million-for-wire-fraud/
2012-11-19/a>	John Bambenek	New Poll: Top 5 Unresolved Security Problems of 2012
2012-11-17/a>	Manuel Humberto Santander Pelaez	New Sysinternal Updates: AdExplorer v1.44, Contig v1.7, Coreinfo v3.2, Procdump v5.1. See http://blogs.technet.com/b/sysinternals/archive/2012/11/16/updates-adexplorer-v1-44-contig-v1-7-coreinfo-v3-2-procdump-v5-1.aspx?Redirected=true
2012-11-16/a>	Manuel Humberto Santander Pelaez	Information Security Incidents are now a concern for colombian government
2012-11-13/a>	Jim Clausing	Microsoft November 2012 Black Tuesday Update - Overview
2012-11-12/a>	John Bambenek	Request for info: Robocall Phishing Against Local/Regional Banks
2012-11-09/a>	Mark Baggett	Remote Diagnostics with PSR
2012-11-09/a>	Mark Baggett	Fresh batch of Microsoft patches next week
2012-11-08/a>	Daniel Wesemann	Get a 40% discount on your hotel room!
2012-11-07/a>	Mark Baggett	Help eliminate unquoted path vulnerabilities
2012-11-07/a>	Mark Baggett	Multiple 0-Days Reported!
2012-11-07/a>	Mark Baggett	Cisco TACACS+ Authentication Bypass
2012-11-05/a>	Johannes Ullrich	Reminder: Ongoing SMTP Brute Forcing Attacks
2012-11-05/a>	Johannes Ullrich	Possible Fake-AV Ads from Doubleclick Servers
2012-11-04/a>	Lorna Hutcheson	What's important on your network?
2012-10-31/a>	Johannes Ullrich	Cyber Security Awareness Month - Day 31 - Business Continuity and Disaster Recovery
2012-10-30/a>	Johannes Ullrich	Hurricane Sandy Update
2012-10-30/a>	Richard Porter	Splunk 5.0 SP-CAAAHB4 http://www.splunk.com/view/SP-CAAAHB4
2012-10-30/a>	Mark Hofman	Cyber Security Awareness Month - Day 30 - DSD 35 mitigating controls
2012-10-28/a>	Tony Carothers	Firefox 16.02 Released
2012-10-26/a>	Adam Swanger	Securing the Human Special Webcast - October 30, 2012
2012-10-26/a>	Russ McRee	Cyber Security Awareness Month - Day 26 - Attackers use trusted domain to propagate Citadel Zeus variant
2012-10-25/a>	Richard Porter	Cyber Security Awareness Month - Day 25 - Pro Audio & Video Packets on the Wire
2012-10-24/a>	Rob VandenBrink	Time to run Windows Update - - Microsoft Updates KB2755801 for Windows RT / IE10 / Flash Player - http://technet.microsoft.com/en-us/security/advisory/2755801
2012-10-24/a>	Russ McRee	Ongoing Windstream outage in the midwest - https://twitter.com/search?q=windstream
2012-10-23/a>	Rob VandenBrink	Cyber Security Awareness Month - Day 23: Character Encoding Standards - ASCII and Successors
2012-10-21/a>	Johannes Ullrich	Cyber Security Awareness Month - Day 22: Connectors
2012-10-21/a>	Lorna Hutcheson	Potential Phish for Regular Webmail Accounts
2012-10-19/a>	Johannes Ullrich	Cyber Security Awareness Month - Day 19: Standard log formats and CEE.
2012-10-18/a>	Rob VandenBrink	Cyber Security Awareness Month - Day 18 - Vendor Standards: The vSphere Hardening Guide
2012-10-17/a>	Mark Hofman	New Acrobat release (including reader) available. Version 11. Some security improvements more here -->http://blogs.adobe.com/adobereader/
2012-10-17/a>	Mark Hofman	Oracle Critical Patch Update October
2012-10-16/a>	Richard Porter	CyberAwareness Month - Day 15, Standards Body Soup (pt2), Same Soup Different Cook.
2012-10-16/a>	Johannes Ullrich	Cyber Security Awareness Month - Day 16: W3C and HTML
2012-10-14/a>	Pedro Bueno	Cyber Security Awareness Month - Day 14 - Poor Man's File Analysis System - Part 1
2012-10-11/a>	Rob VandenBrink	Cyber Security Awareness Month - Day 11 - Vendor Agnostic Standards (Center for Internet Security)
2012-10-09/a>	Johannes Ullrich	Microsoft October 2012 Black Tuesday Update - Overview
2012-10-07/a>	Tony Carothers	Cyber Security Awareness Month - Day 7 - Rollup Review of CSAM Week 1
2012-10-05/a>	Johannes Ullrich	Cyber Security Awareness Month - Day 5: Standards Body Soup, So many Flavors in the bowl.
2012-10-05/a>	Richard Porter	VMWare Security Advisory: VMSA-2012-0014 - http://www.vmware.com/security/advisories/VMSA-2012-0014.html
2012-10-05/a>	Richard Porter	Reports of a Distributed Injection Scan
2012-10-04/a>	Mark Hofman	And the SHA-3 title goes to .....Keccak
2012-10-04/a>	Johannes Ullrich	Cyber Security Awareness Month - Day 4: Crypto Standards
2012-10-03/a>	Kevin Shortt	Fake Support Calls Reported
2012-10-02/a>	Russ McRee	Cyber Security Awareness Month - Day 2 - PCI Security Standard: Mobile Payment Acceptance Security Guidelines
2012-10-01/a>	Johannes Ullrich	Cyber Security Awareness Month
2012-09-28/a>	Joel Esler	Adobe certification revocation for October 4th
2012-09-26/a>	Johannes Ullrich	Some Android phones can be reset to factory default by clicking on links
2012-09-26/a>	Johannes Ullrich	More Java Woes
2012-09-21/a>	Johannes Ullrich	iOS 6 Security Roundup
2012-09-20/a>	Russ McRee	Flash Player update but no announcement, check your version http://www.adobe.com/software/flash/about/
2012-09-20/a>	Russ McRee	Apple and Cisco Security Advisories 19 SEP 2012
2012-09-20/a>	Russ McRee	Financial sector advisory: attacks and threats against financial institutions
2012-09-19/a>	Russ McRee	Script kiddie scavenging with Shellbot.S
2012-09-17/a>	Rob VandenBrink	What's on your iPad?
2012-09-14/a>	Lenny Zeltser	Analyzing Malicious RTF Files Using OfficeMalScanner's RTFScan
2012-09-14/a>	Lenny Zeltser	Scam Report - Fake Voice Mail Email Notification Redirects to Malicious Site
2012-09-13/a>	Mark Baggett	TCP Fuzzing with Scapy
2012-09-13/a>	Mark Baggett	Microsoft disrupts traffic associated with the Nitol botnet
2012-09-13/a>	Mark Baggett	More SSL trouble
2012-09-11/a>	Adam Swanger	Microsoft September 2012 Black Tuesday Update - Overview
2012-09-10/a>	Johannes Ullrich	Godaddy DDoS Attack
2012-09-10/a>	donald smith	Blue Toad publishing co compromise lead to UDID release. http://redtape.nbcnews.com/_news/2012/09/10/13781440-exclusive-the-real-source-of-apple-device-ids-leaked-by-anonymous-last-week?lite
2012-09-10/a>	Johannes Ullrich	Microsoft Patch Tuesday Pre-Release
2012-09-09/a>	Guy Bruneau	Phishing/Spam Pretending to be from BBB
2012-09-08/a>	Guy Bruneau	Webmin Input Validation Vulnerabilities
2012-09-06/a>	Johannes Ullrich	SSL Requests sent to port 80 (request for help/input)
2012-09-04/a>	Johannes Ullrich	Another round of "Spot the Exploit E-Mail"
2012-09-02/a>	Lorna Hutcheson	Demonstrating the value of your Intrusion Detection Program and Analysts
2012-09-01/a>	Russ McRee	Blackhole targeting Java vulnerability via fake Microsoft Services Agreement email phish
2012-08-31/a>	Russ McRee	Not so fast: Java 7 Update 7 critical vulnerability discovered in less than 24 hours
2012-08-30/a>	Bojan Zdrnja	Analyzing outgoing network traffic (part 2)
2012-08-30/a>	Johannes Ullrich	Editorial: The Slumlord Approach to Network Security http://isc.sans.edu/j/editorial
2012-08-29/a>	Johannes Ullrich	"Data" URLs used for in-URL phishing
2012-08-27/a>	Johannes Ullrich	The Good, Bad and Ugly about Assigning IPv6 Addresses
2012-08-27/a>	Johannes Ullrich	Malware Spam harvesting Facebook Information
2012-08-26/a>	Lorna Hutcheson	Who ya gonna contact?
2012-08-23/a>	Bojan Zdrnja	Analyzing outgoing network traffic
2012-08-22/a>	Adrien de Beaupre	Phishing/spam via SMS
2012-08-22/a>	Adrien de Beaupre	Apple Remote Desktop update fixes no encryption issue
2012-08-21/a>	Adrien de Beaupre	YYABCAFU - Yes Yet Another Bleeping Critical Adobe Flash Update
2012-08-21/a>	Adrien de Beaupre	RuggedCom fails key management 101 on Rugged Operating System (ROS)
2012-08-20/a>	Manuel Humberto Santander Pelaez	Do we need test procedures in our companies before implementing Antivirus signatures?
2012-08-19/a>	Manuel Humberto Santander Pelaez	Authentication Issues between entities during protocol message exchange in SCADA Systems
2012-08-17/a>	Guy Bruneau	Suspicious eFax Spear Phishing Messages
2012-08-14/a>	Rick Wanner	Microsoft August 2012 Black Tuesday Update - Overview
2012-08-12/a>	Tony Carothers	Layers of the Defense-in-Depth Onion
2012-08-12/a>	Tony Carothers	Oracle Security Alert for CVE-2012-3132
2012-08-09/a>	Mark Hofman	Zeus/Citadel variant causing issues in the Netherlands
2012-08-09/a>	Mark Hofman	SQL Injection Lilupophilupop style, Part 2
2012-08-07/a>	Adrien de Beaupre	Who protects small business?
2012-08-05/a>	Daniel Wesemann	Phishing for Payroll with unpatched Java
2012-08-04/a>	Kevin Liston	Vendors: More Patch-Release Options Please
2012-07-31/a>	Daniel Wesemann	SQL injection, lilupophilupop-style
2012-07-30/a>	Guy Bruneau	BIND 9 Security Updates
2012-07-27/a>	Daniel Wesemann	Cuckoo 0.4 is out - cool new features for malware analysis http://www.cuckoosandbox.org/
2012-07-25/a>	Johannes Ullrich	Apple OS X 10.8 (Mountain Lion) released
2012-07-25/a>	Johannes Ullrich	Microsoft Exchange/Sharepoint and others: Oracle Outside In Vulnerability
2012-07-24/a>	Richard Porter	Wireshark 1.8.1 Released http://www.wireshark.org/
2012-07-24/a>	Richard Porter	Report of spike in DNS Queries gd21.net
2012-07-21/a>	Rick Wanner	TippingPoint DNS Version Request increase
2012-07-20/a>	Mark Baggett	Syria Internet connection cut?
2012-07-19/a>	Mark Baggett	Diagnosing Malware with Resource Monitor
2012-07-19/a>	Mark Baggett	A Heap of Overflows?
2012-07-16/a>	Richard Porter	Sysinternals Update @ http://blogs.technet.com/b/sysinternals/archive/2012/07/16/updates-handle-v3-5-process-explorer-v15-22-process-monitor-v3-03-rammap-v1-21-zoomit-v4-3.aspx
2012-07-16/a>	Jim Clausing	An analysis of the Yahoo! passwords
2012-07-13/a>	Richard Porter	Yesterday (not as on the ball as Rob) at SANSFire
2012-07-13/a>	Russ McRee	2 for 1: SANSFIRE & MSRA presentations
2012-07-13/a>	Russ McRee	Yahoo service SQL injection vuln leads to account exposure
2012-07-12/a>	Rick Wanner	Cisco Security Advisory: Multiple Vulnerabilities in Cisco TelePresence Immersive Endpoint Devices - http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120711-cts
2012-07-12/a>	Rick Wanner	Cisco Security Advisory: Multiple Vulnerabilities in Cisco TelePresence Manager - http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120711-ctsman
2012-07-12/a>	Rick Wanner	Cisco Security Advisory: Multiple Vulnerabilities in Cisco TelePresence Multipoint Switch - http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120711-ctms
2012-07-12/a>	Rick Wanner	Cisco Security Advisory: Multiple Vulnerabilities in Cisco TelePresence Recording Server - http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120711-ctrs
2012-07-10/a>	Rob VandenBrink	Today at SANSFIRE (09 July 2012) - ISC Panel Discussion on the State of the Internet
2012-07-09/a>	Johannes Ullrich	The FBI will turn off the Internet on Monday (or not)
2012-07-09/a>	Manuel Humberto Santander Pelaez	Internet Storm Center panel tonight at SANSFIRE 2012!
2012-07-05/a>	Adrien de Beaupre	New OS X trojan backdoor MaControl variant reported
2012-07-05/a>	Adrien de Beaupre	Microsoft advanced notification for July 2012 patch Tuesday
2012-07-02/a>	Joel Esler	A rough guide to keeping your website up
2012-07-02/a>	Dan Goldberg	Storms of June 29th 2012 in Mid Atlantic region of the USA
2012-07-02/a>	Joel Esler	Linux & Java leap second bug
2012-06-29/a>	Jim Clausing	Updated SysInternals tools - Autoruns, Process Explorer, Process Monitor, PSKill -- http://blogs.technet.com/b/sysinternals/archive/2012/06/28/updates-autoruns-v11-32-process-explorer-v15-21-process-monitor-v3-02-pskill-v1-15-rammap-v1-2.aspx
2012-06-28/a>	Chris Mohan	Massive spike in BGP traffic - Possible BGP poisoning?
2012-06-27/a>	Daniel Wesemann	What's up with port 79 ?
2012-06-25/a>	Rick Wanner	Targeted Malware for Industrial Espionage?
2012-06-25/a>	Guy Bruneau	Issues with Windows Update Agent
2012-06-22/a>	Kevin Liston	Investigator's Tool-kit: Timeline
2012-06-21/a>	Raul Siles	Print Bomb? (Take 2)
2012-06-21/a>	Russ McRee	Analysis of drive-by attack sample set
2012-06-21/a>	Russ McRee	Wireshark 1.8.0 released 21 JUN 2012 http://www.wireshark.org/download.html
2012-06-19/a>	Daniel Wesemann	Vulnerabilityqueerprocessbrittleness
2012-06-14/a>	Johannes Ullrich	Spot the Phish: Verizon Wireless
2012-06-10/a>	Scott Fendley	Preying on Users After Major Security Incidents
2012-06-06/a>	Jim Clausing	BIND 9 Update - DoS or information disclosure vulnerability
2012-06-06/a>	Jim Clausing	Potential leak of 6.5+ million LinkedIn password hashes
2012-06-04/a>	Lenny Zeltser	Decoding Common XOR Obfuscation in Malicious Code
2012-06-04/a>	Rob VandenBrink	vSphere 5.0 Hardening Guide Officially Released
2012-05-30/a>	Rob VandenBrink	It's Phishing Season! In fact, it's ALWAYS Phishing Season!
2012-05-23/a>	Mark Baggett	Problems with MS12-035 affecting XP, SBS and Windows 2003?
2012-05-14/a>	Chris Mohan	Laptops at Security Conferences
2012-05-08/a>	Bojan Zdrnja	Windows Firewall Bypass Vulnerability and NetBIOS NS
2012-05-06/a>	Jim Clausing	Tool updates and Win 8
2012-04-30/a>	Rob VandenBrink	FCC posts Enquiry Documents on Google Wardriving
2012-04-23/a>	Russ McRee	Emergency Operations Centers & Security Incident Management: A Correlation
2012-04-18/a>	Kevin Shortt	Sysinternals Updates - 2012 Apr 17
2012-04-10/a>	Swa Frantzen	Windows Vista RIP
2012-04-06/a>	Johannes Ullrich	Social Share Privacy
2012-03-16/a>	Swa Frantzen	INFOCON Yellow - Microsoft RDP - MS12-020
2012-03-13/a>	Lenny Zeltser	Please transfer this email to your CEO or appropriate person, thanks
2012-02-20/a>	Johannes Ullrich	The Ultimate OS X Hardening Guide Collection
2012-02-20/a>	Pedro Bueno	Simple Malware Research Tools
2012-01-31/a>	Russ McRee	OSINT tactics: parsing from FOCA for Maltego
2012-01-24/a>	Bojan Zdrnja	Is it time to get rid of NetBIOS?
2012-01-21/a>	Guy Bruneau	DNS Sinkhole Scripts Fixes/Update
2012-01-19/a>	Chris Mohan	WHOIS contacts are your friends
2012-01-13/a>	Guy Bruneau	Sysinternals Updates - http://blogs.technet.com/b/sysinternals/archive/2012/01/13/updates-autoruns-v11-21-coreinfo-v3-03-portmon-v-3-03-process-explorer-v15-12-mark-s-blog-and-mark-at-rsa-2012.aspx
2012-01-12/a>	Rob VandenBrink	Stuff I Learned Scripting - Fun with STDERR
2011-12-25/a>	Deborah Hale	Merry Christmas, Happy Holidays
2011-12-23/a>	Daniel Wesemann	Printer Pranks
2011-12-21/a>	Johannes Ullrich	New Vulnerability in Windows 7 64 bit
2011-12-12/a>	Daniel Wesemann	You won 100$ or a free iPad!
2011-12-08/a>	Adrien de Beaupre	Microsoft Security Bulletin Advance Notification for December 2011
2011-12-06/a>	Kevin Shortt	Cain & Abel v4.9.43 Released - http://www.oxid.it/
2011-12-05/a>	Stephen Hall	ISC describe DNS crash bug analysis
2011-12-01/a>	Mark Hofman	SQL Injection Attack happening ATM
2011-11-29/a>	John Bambenek	Hacking HP Printers for Fun and Profit
2011-11-28/a>	Tom Liston	A Puzzlement...
2011-11-24/a>	Russ McRee	Quick Tip: Pastebin Monitoring & Recon
2011-11-23/a>	Johannes Ullrich	SCADA hacks published on Pastebin
2011-11-16/a>	Jason Lam	Potential 0-day on Bind 9
2011-11-11/a>	Rick Wanner	Yay! More Sysinternals updates! http://technet.microsoft.com/en-us/sysinternals
2011-11-10/a>	Rob VandenBrink	Stuff I Learned Scripting - - Parsing XML in a One-Liner
2011-10-29/a>	Richard Porter	The Sub Critical Control? Evidence Collection
2011-10-28/a>	Russ McRee	Critical Control 19: Data Recovery Capability
2011-10-27/a>	Mark Baggett	Critical Control 18: Incident Response Capabilities
2011-10-26/a>	Rick Wanner	Critical Control 17:Penetration Tests and Red Team Exercises
2011-10-25/a>	Chris Mohan	Recurring reporting made easy?
2011-10-21/a>	Johannes Ullrich	New Flash Click Jacking Exploit
2011-10-17/a>	Rob VandenBrink	Critical Control 11: Account Monitoring and Control
2011-10-15/a>	Guy Bruneau	DNS Sinkhole Parser Script Update
2011-10-10/a>	Tom Liston	What's In A Name?
2011-10-02/a>	Mark Hofman	Cyber Security Awareness Month Day 1/2 - Schedule
2011-10-02/a>	Mark Hofman	Cyber Security Awareness Month Day 1/2 - Introduction to the controls
2011-09-29/a>	Daniel Wesemann	The SSD dilemma
2011-09-20/a>	Swa Frantzen	Diginotar declared bankrupt
2011-09-19/a>	Guy Bruneau	MS Security Advisory Update - Fraudulent DigiNotar Certificates
2011-09-15/a>	Swa Frantzen	DigiNotar looses their accreditation for qualified certificates
2011-09-13/a>	Swa Frantzen	GlobalSign back in operation
2011-09-13/a>	Swa Frantzen	More DigiNotar intermediate certificates blocklisted at Microsoft
2011-09-09/a>	Guy Bruneau	IPv6 and DNS Sinkhole
2011-09-07/a>	Lenny Zeltser	GlobalSign Temporarily Stops Issuing Certificates to Investigate a Potential Breach
2011-09-06/a>	Swa Frantzen	DigiNotar audit - intermediate report available
2011-09-06/a>	Johannes Ullrich	Microsoft Releases Diginotar Related Patch and Advisory
2011-09-05/a>	Bojan Zdrnja	Bitcoin – crypto currency of future or heaven for criminals?
2011-09-01/a>	Swa Frantzen	DigiNotar breach - the story so far
2011-08-31/a>	Johannes Ullrich	Firefox/Thunderbird 6.0.1 released to blocklist bad DigiNotar SSL certificates
2011-08-31/a>	Johannes Ullrich	Phishing e-mail to custom e-mail addresses
2011-08-31/a>	Johannes Ullrich	Kernel.org Compromise
2011-08-26/a>	Daniel Wesemann	User Agent 007
2011-08-25/a>	Kevin Shortt	Increased Traffic on Port 3389
2011-08-24/a>	Rob VandenBrink	Citrix Access Gateway Cross Site Scripting vulnerability and fix ==> http://support.citrix.com/article/CTX129971
2011-08-17/a>	Rob VandenBrink	Putting all of Your Eggs in One Basket - or How NOT to do Layoffs
2011-08-17/a>	Rob VandenBrink	Sysinternal updates for ProcDump v4.0, Process Monitor v2.96, Process Explorer v15.02 ==> http://blogs.technet.com/b/sysinternals/
2011-08-16/a>	Scott Fendley	Phishing Scam Victim Response
2011-08-15/a>	Rob VandenBrink	8 Years since the Eastern Seaboard Blackout - Has it Been that Long?
2011-08-08/a>	Rob VandenBrink	Ping is Bad (Sometimes)
2011-08-05/a>	Johannes Ullrich	Microsoft Patch Tuesday Advance Notification: 13 Bulletins coming http://www.microsoft.com/technet/security/Bulletin/MS11-aug.mspx
2011-07-31/a>	Daniel Wesemann	Anatomy of a Unix breach
2011-07-25/a>	Chris Mohan	Monday morning incident handler practice
2011-07-17/a>	Mark Hofman	SSH Brute Force
2011-07-09/a>	Chris Mohan	Safer Windows Incident Response
2011-07-07/a>	Rob VandenBrink	"There's a Patch for that" (or maybe not)
2011-07-06/a>	Rob VandenBrink	"Too Important to Patch" - Wait? What?
2011-07-05/a>	Raul Siles	Two DoS remotely exploitable vulnerabilities affect BIND 9: http://www.isc.org/advisories/bind Updgrade to 9.8.0-P4.
2011-07-03/a>	Deborah Hale	Business Continuation in the Face of Disaster
2011-06-30/a>	Rob VandenBrink	Update for RSA Authentication Manager
2011-06-28/a>	Johannes Ullrich	DNSSEC Tips
2011-06-22/a>	Guy Bruneau	How Good is your Employee Termination Policy?
2011-06-17/a>	Richard Porter	When do you stop owning Technology?
2011-06-12/a>	Mark Hofman	Cloud thoughts
2011-06-09/a>	Richard Porter	One Browser to Rule them All?
2011-06-08/a>	Johannes Ullrich	Spam from compromised Hotmail accounts
2011-06-06/a>	Johannes Ullrich	The Havij SQL Injection Tool
2011-06-06/a>	Manuel Humberto Santander Pelaez	Phishing: Same goal, same techniques and people still falling for such scams
2011-06-03/a>	Guy Bruneau	SonyPictures Site Compromised
2011-06-01/a>	Johannes Ullrich	Enabling Privacy Enhanced Addresses for IPv6
2011-05-30/a>	Johannes Ullrich	Lockheed Martin and RSA Tokens
2011-05-25/a>	Lenny Zeltser	Monitoring Social Media for Security References to Your Organization
2011-05-20/a>	Guy Bruneau	Sysinternals Updates, Analyzing Stuxnet Infection with Sysinternals Tools Part 3
2011-05-10/a>	Swa Frantzen	Changing MO in scamming our users ?
2011-05-09/a>	Johannes Ullrich	Patch for BIND 9.8.0 DoS Vulnerability
2011-05-06/a>	Richard Porter	Updated Exploit Index for Microsoft
2011-05-04/a>	Richard Porter	Microsoft Sysinterals Update
2011-05-03/a>	Johannes Ullrich	Update on Osama Bin Laden themed Malware
2011-05-02/a>	Johannes Ullrich	Bin Laden Death Related Malware
2011-05-01/a>	Deborah Hale	Droid MarketPlace Has a New App
2011-04-26/a>	John Bambenek	Is the Insider Threat Really Over?
2011-04-25/a>	Rob VandenBrink	Sony PlayStation Network Outage - Day 5
2011-04-19/a>	Bojan Zdrnja	SQL injection: why can’t we learn?
2011-04-14/a>	Adrien de Beaupre	Sysinternals updates, a new blog post, and webcast
2011-04-11/a>	Johannes Ullrich	GMail User Using 2FA Warned of Access From China
2011-04-07/a>	Chris Mohan	Being a good internet neighbour
2011-04-01/a>	John Bambenek	LizaMoon Mass SQL-Injection Attack Infected at least 500k Websites
2011-03-27/a>	Guy Bruneau	Strange Shockwave File with Surprising Attachments
2011-03-25/a>	Kevin Liston	APT Tabletop Exercise
2011-03-22/a>	Chris Mohan	Read only USB stick trick
2011-03-15/a>	Lenny Zeltser	Limiting Exploit Capabilities by Using Windows Integrity Levels
2011-03-07/a>	Bojan Zdrnja	Oracle padding attacks (Codegate crypto 400 writeup)
2011-02-28/a>	Deborah Hale	Possible Botnet Scanning
2011-02-25/a>	Johannes Ullrich	Thunderbolt Security Speculations
2011-02-24/a>	Johannes Ullrich	Windows 7 / 2008 R2 Service Pack 1 Problems
2011-02-23/a>	Johannes Ullrich	Windows 7 Service Pack 1 out
2011-02-23/a>	Manuel Humberto Santander Pelaez	Bind DOS vulnerability (CVE-2011-0414)
2011-02-21/a>	Adrien de Beaupre	Winamp forums compromised
2011-02-16/a>	Jason Lam	Windows 0-day SMB mrxsmb.dll vulnerability
2011-02-10/a>	Chris Mohan	Befriending Windows Security Log Events
2011-02-09/a>	Mark Hofman	Adobe Patches (shockwave, Flash, Reader & Coldfusion)
2011-02-08/a>	Johannes Ullrich	Tippingpoint Releases Details on Unpatched Bugs
2011-02-07/a>	Richard Porter	Crime is still Crime! Pt 2
2011-02-05/a>	Guy Bruneau	OpenSSH Legacy Certificate Information Disclosure Vulnerability
2011-02-02/a>	Johannes Ullrich	Having Phish on Friday
2011-01-30/a>	Richard Porter	The Modern Dark Ages?
2011-01-27/a>	Robert Danford	Microsoft Security Advisory for MHTML via Internet Explorer (MS2501696/CVE-2011-0096)
2011-01-25/a>	Chris Mohan	Reviewing our preconceptions
2011-01-24/a>	Rob VandenBrink	Where have all the COM Ports Gone? - How enumerating COM ports led to me finding a “misplaced” Microsoft tool
2011-01-23/a>	Richard Porter	Crime is still Crime!
2011-01-12/a>	Richard Porter	How Many Loyalty Cards do you Carry?
2011-01-12/a>	Richard Porter	Yet Another Data Broker? AOL Lifestream.
2011-01-10/a>	Manuel Humberto Santander Pelaez	VirusTotal VTzilla firefox/chrome plugin
2011-01-05/a>	Johannes Ullrich	Currently Unpatched Windows / Internet Explorer Vulnerabilities
2011-01-04/a>	Johannes Ullrich	Microsoft Advisory: Vulnerability in Graphics Rendering Engine
2010-12-29/a>	Daniel Wesemann	Beware of strange web sites bearing gifts ...
2010-12-26/a>	Manuel Humberto Santander Pelaez	ISC infocon monitor app for OS X
2010-12-23/a>	Mark Hofman	Skoudis' Annual Xmas Hacking Challenge - The Nightmare Before Charlie Brown's Christmas
2010-12-21/a>	Rob VandenBrink	Network Reliability, Part 2 - HSRP Attacks and Defenses
2010-12-19/a>	Raul Siles	Intel's new processors have a remote kill switch (Anti-Theft 3.0)
2010-12-10/a>	Mark Hofman	Microsoft patches
2010-12-05/a>	Jim Clausing	Updates to a couple of Sysinternals tools
2010-12-02/a>	Kevin Johnson	Robert Hansen and our happiness
2010-12-02/a>	Kevin Johnson	SQL Injection: Wordpress 3.0.2 released
2010-11-29/a>	Stephen Hall	iPhone phishing - What you see, isn't what you get
2010-11-26/a>	Mark Hofman	Using password cracking as metric/indicator for the organisation's security posture
2010-11-24/a>	Bojan Zdrnja	Privilege escalation 0-day in almost all Windows versions
2010-11-22/a>	Lenny Zeltser	Brand Impersonations On-Line: Brandjacking and Social Networks
2010-11-19/a>	Jason Lam	Exchanging and sharing of assessment results
2010-11-18/a>	Chris Carboni	Stopping the ZeroAccess Rootkit
2010-11-17/a>	Guy Bruneau	Cisco Unified Videoconferencing Affected by Multiple Vulnerabilities
2010-11-15/a>	Stephen Hall	Minibis hits beta with Version 2.1
2010-11-01/a>	Manuel Humberto Santander Pelaez	Checkpoint UTM-1 edge VPN boxes worldwide did an unscheduled reboot
2010-10-26/a>	Pedro Bueno	Be (even more) careful with public hotspots. Firesheep released yesterday. Brilliant and scary.
2010-10-22/a>	Manuel Humberto Santander Pelaez	Intypedia project
2010-10-18/a>	Manuel Humberto Santander Pelaez	Cyber Security Awareness Month - Day 18 - What you should tell your boss when there's a crisis
2010-10-11/a>	Adrien de Beaupre	OT: Happy Thanksgiving Day Canada
2010-10-04/a>	Mark Hofman	Online Voting
2010-09-25/a>	Rick Wanner	Guest Diary: Andrew Hunt - Visualizing the Hosting Patterns of Modern Cybercriminals
2010-09-17/a>	Robert Danford	Circa 2007 Linux Kernel Vulnerability Resurfaces (Was CVE-2007-4573, Now CVE-2010-3301)
2010-09-16/a>	Johannes Ullrich	Facebook "Like Pages"
2010-09-04/a>	Kevin Liston	Investigating Malicious Website Reports
2010-08-27/a>	Mark Hofman	FTP Brute Password guessing attacks
2010-08-23/a>	Manuel Humberto Santander Pelaez	Firefox plugins to perform penetration testing activities
2010-08-23/a>	Bojan Zdrnja	DLL hijacking vulnerabilities
2010-08-16/a>	Raul Siles	Blind Elephant: A New Web Application Fingerprinting Tool
2010-08-15/a>	Manuel Humberto Santander Pelaez	Obfuscated SQL Injection attacks
2010-08-13/a>	Guy Bruneau	Shadowserver Binary Whitelisting Service
2010-08-10/a>	Daniel Wesemann	SSH - new brute force tool?
2010-08-07/a>	Stephen Hall	Countdown to Tuesday...
2010-08-05/a>	Rob VandenBrink	Access Controls for Network Infrastructure
2010-08-04/a>	Tom Liston	Incident Reporting - Liston's "How-To" Guide
2010-08-03/a>	Johannes Ullrich	When Lightning Strikes
2010-08-02/a>	Manuel Humberto Santander Pelaez	Securing Windows Internet Kiosk
2010-07-29/a>	Rob VandenBrink	NoScript 2.0 released
2010-07-26/a>	Guy Bruneau	SophosLabs Released Free Tool to Validate Microsoft Shortcut
2010-07-24/a>	Manuel Humberto Santander Pelaez	Transmiting logon information unsecured in the network
2010-07-23/a>	Mark Hofman	vBulletin vB 3.8.6 vulnerability
2010-07-23/a>	Mark Hofman	Some of our favourite sysinternals tools have been updated. TCPview, Autoruns, ProcDump and Disk2vhd have changed. More here http://blogs.technet.com/b/sysinternals/archive/2010/07/22/updates-tcpview-v3-0-autoruns-v10-02-procdump-v1-81-disk2vhd-v1-61.aspx
2010-07-20/a>	Manuel Humberto Santander Pelaez	Lowering infocon back to green
2010-07-07/a>	Kevin Shortt	Facebook, Facebook, What Do YOU See?
2010-07-04/a>	Manuel Humberto Santander Pelaez	New Winpcap Version
2010-06-27/a>	Manuel Humberto Santander Pelaez	Study of clickjacking vulerabilities on popular sites
2010-06-19/a>	Guy Bruneau	DNS Sinkhole ISO Available for Download
2010-06-18/a>	Tom Liston	IMPORTANT INFORMATION: Distributed SSH Brute Force Attacks
2010-06-17/a>	Deborah Hale	Digital Copy Machines - Security Risk?
2010-06-17/a>	Deborah Hale	Internet Fraud Alert Kicks Off Today
2010-06-15/a>	Manuel Humberto Santander Pelaez	Microsoft Windows Help and Support Center vulnerability (CVE 2010-1885) exploit in the wild
2010-06-15/a>	Manuel Humberto Santander Pelaez	iPhone 4 Order Security Breach Exposes Private Information
2010-06-14/a>	Manuel Humberto Santander Pelaez	New way of social engineering on IRC
2010-06-10/a>	Deborah Hale	Top 5 Social Networking Media Risks
2010-06-09/a>	Deborah Hale	Mass Infection of IIS/ASP Sites
2010-06-07/a>	Manuel Humberto Santander Pelaez	Software Restriction Policy to keep malware away
2010-06-06/a>	Manuel Humberto Santander Pelaez	Nice OS X exploit tutorial
2010-06-04/a>	Johannes Ullrich	Changes to Internet Storm Center Host Name
2010-06-02/a>	Bojan Zdrnja	Clickjacking attacks on Facebook's Like plugin
2010-05-25/a>	donald smith	Face book “joke” leads to firing.
2010-05-19/a>	Jason Lam	EFF paper about browser tracking
2010-05-07/a>	Johannes Ullrich	Stock market "wipe out" may be due to computer error
2010-05-04/a>	Rick Wanner	SIFT review in the ISSA Toolsmith
2010-05-02/a>	Mari Nichols	Zbot Social Engineering
2010-04-30/a>	Johannes Ullrich	Sharepoint XSS Vulnerability
2010-04-30/a>	Kevin Liston	CVE-2010-0817 SharePoint XSS Scorecard
2010-04-29/a>	Bojan Zdrnja	Who needs exploits when you have social engineering?
2010-04-21/a>	Guy Bruneau	Google Chrome Security Update v4.1.249.1059 Released: http://googlechromereleases.blogspot.com/2010/04/stable-update-security-fixes.html
2010-04-20/a>	Raul Siles	Are You Ready for a Transportation Collapse...?
2010-04-19/a>	Daniel Wesemann	Linked into scams?
2010-04-14/a>	Mark Hofman	And let the patching games continue
2010-04-13/a>	Adrien de Beaupre	Web App Testing Tools
2010-04-13/a>	Johannes Ullrich	More Legal Threat Malware E-Mail
2010-04-02/a>	Guy Bruneau	Oracle Java SE and Java for Business Critical Patch Update Advisory
2010-03-27/a>	Guy Bruneau	HP-UX Running NFS/ONCplus, Inadvertently Enabled NFS
2010-03-27/a>	Guy Bruneau	Create a Summary of IP Addresses from PCAP Files using Unix Tools
2010-03-21/a>	Chris Carboni	Responding To The Unexpected
2010-03-18/a>	Bojan Zdrnja	Dangers of copy&paste
2010-03-15/a>	Adrien de Beaupre	Spamassassin Milter Plugin Remote Root Attack
2010-03-06/a>	Tony Carothers	Integration and the Security of New Technologies
2010-02-22/a>	Rob VandenBrink	New Risks in Penetration Testing
2010-02-17/a>	Rob VandenBrink	Multiple Security Updates for ESX 3.x and ESXi 3.x
2010-02-15/a>	Johannes Ullrich	Various Olympics Related Dangerous Google Searches
2010-02-12/a>	G. N. White	Time to update those IP Bogon Filters (again)
2010-02-11/a>	Deborah Hale	The Mysterious Blue Screen
2010-02-06/a>	Guy Bruneau	LANDesk Management Gateway Vulnerability
2010-02-03/a>	Johannes Ullrich	Information Disclosure Vulnerability in Internet Explorer
2010-02-02/a>	Johannes Ullrich	Twitter Mass Password Reset due to Phishing
2010-02-01/a>	Rob VandenBrink	NMAP 5.21 - Is UDP Protocol Specific Scanning Important? Why Should I Care?
2010-01-27/a>	Raul Siles	Command Line Kung Fu
2010-01-26/a>	Rob VandenBrink	VMware vSphere Hardening Guide Draft posted for public review
2010-01-22/a>	Mari Nichols	Pass-down for a Successful Incident Response
2010-01-17/a>	Mark Hofman	Why not Yellow?
2010-01-14/a>	Bojan Zdrnja	0-day vulnerability in Internet Explorer 6, 7 and 8
2010-01-10/a>	Guy Bruneau	Easy DNS BIND Sinkhole Setup
2010-01-09/a>	G. N. White	What's Up With All The Port Scanning Using TCP/6000 As A Source Port?
2010-01-08/a>	Rob VandenBrink	Microsoft OfficeOnline, Searching for Trust and Malware
2009-12-17/a>	Daniel Wesemann	overlay.xul is back
2009-12-16/a>	Rob VandenBrink	Beware the Attack of the Christmas Greeting Cards !
2009-12-15/a>	Johannes Ullrich	Important BIND name server updates - DNSSEC
2009-12-04/a>	Daniel Wesemann	The economics of security advice (MSFT research paper)
2009-12-02/a>	Rob VandenBrink	SPAM and Malware taking advantage of H1N1 concerns
2009-11-29/a>	Patrick Nolan	A Cloudy Weekend
2009-11-25/a>	Jim Clausing	Tool updates
2009-11-24/a>	Rick Wanner	Microsoft Security Advisory 977981 - IE 6 and IE 7
2009-11-24/a>	John Bambenek	BIND Security Advisory (DNSSEC only)
2009-11-14/a>	Adrien de Beaupre	Microsoft advisory for Windows 7 / Windows Server 2008 R2 Remote SMB DoS Exploit released
2009-11-13/a>	Adrien de Beaupre	Flash Origin Policy Attack
2009-11-12/a>	Rob VandenBrink	Windows 7 / Windows Server 2008 Remote SMB Exploit
2009-11-11/a>	Rob VandenBrink	Layer 2 Network Protections against Man in the Middle Attacks
2009-11-09/a>	Chris Carboni	80's Flashback on Jailbroken iPhones
2009-11-05/a>	Swa Frantzen	Insider threat: The snapnames case
2009-10-26/a>	Johannes Ullrich	Today: ISC Login bugfix day. If you have issues logging in using OpenID, please email a copy of your OpenID URL to jullrich\at\sans.edu
2009-10-24/a>	Marcus Sachs	Windows 7 - How is it doing?
2009-10-22/a>	Adrien de Beaupre	Sysinternals updates: Disk2vhd v1.1, ZoomIt v4.1, Coreinfo v2.0, VMMap v2.4
2009-10-19/a>	Daniel Wesemann	Scam Email
2009-10-17/a>	Rick Wanner	Mozilla disables Microsoft plug-ins?
2009-10-16/a>	Adrien de Beaupre	Disable MS09-054 patch, or Firefox Plugin?
2009-10-13/a>	Daniel Wesemann	Adobe Reader and Acrobat - Black Tuesday continues
2009-10-08/a>	Johannes Ullrich	Firefox Plugin Collections
2009-10-04/a>	Guy Bruneau	Samba Security Information Disclosure and DoS
2009-10-02/a>	Stephen Hall	New SysInternal fun for the weekend
2009-09-27/a>	Stephen Hall	Use Emerging Threats signatures? READ THIS!
2009-09-20/a>	Mari Nichols	Insider Threat and Security Awareness
2009-09-19/a>	Rick Wanner	Sysinternals Tools Updates
2009-09-08/a>	Guy Bruneau	Vista/2008/Windows 7 SMB2 BSOD 0Day
2009-09-05/a>	Mark Hofman	Critical Infrastructure and dependencies
2009-08-26/a>	Johannes Ullrich	WSUS 3.0 SP2 released
2009-08-26/a>	Johannes Ullrich	Cisco over-the-air-provisioning skyjacking exploit
2009-08-19/a>	Daniel Wesemann	Checking your protection
2009-08-18/a>	Deborah Hale	Website compromises - what's happening?
2009-08-18/a>	Deborah Hale	Sysinternals Procdump Updated
2009-08-13/a>	Jim Clausing	New and updated cheat sheets
2009-08-03/a>	Mark Hofman	Switch hardening on your network
2009-08-01/a>	Deborah Hale	Website Warnings
2009-07-31/a>	Deborah Hale	Don't forget to tell your SysAdmin Thanks
2009-07-31/a>	Deborah Hale	Google Safe Browsing
2009-07-29/a>	Bojan Zdrnja	BIND 9 DoS attacks in the wild
2009-07-27/a>	Raul Siles	Filemon and Regmon are dead, long life to Procmon!
2009-07-27/a>	Raul Siles	New Hacker Challenge: Prison Break - Breaking, Entering & Decoding
2009-07-18/a>	Patrick Nolan	Chrome update contains Security fixes
2009-07-17/a>	Bojan Zdrnja	A new fascinating Linux kernel vulnerability
2009-07-16/a>	Guy Bruneau	Changes in Windows Security Center
2009-07-16/a>	Bojan Zdrnja	OWC exploits used in SQL injection attacks
2009-07-13/a>	Adrien de Beaupre	* Infocon raised to yellow for Excel Web Components ActiveX vulnerability
2009-07-12/a>	Mari Nichols	CA Apologizes for False Positive
2009-07-10/a>	Guy Bruneau	WordPress Fixes Multiple vulnerabilities
2009-07-07/a>	Marcus Sachs	* INFOCON Status - staying green
2009-07-03/a>	Adrien de Beaupre	Happy 4th of July!
2009-07-02/a>	Daniel Wesemann	Time to update updating on PCs for 3rd party apps
2009-07-02/a>	Daniel Wesemann	Unpatched Bloatware on new PCs
2009-06-26/a>	Mark Hofman	PHPMYADMIN scans
2009-06-24/a>	Kyle Haugsness	Exploit tools are publicly available for phpMyAdmin
2009-06-24/a>	Kyle Haugsness	TCP scanning increase for 4899
2009-06-21/a>	Scott Fendley	phpMyAdmin Scans
2009-06-20/a>	Scott Fendley	Situational Awareness: Spam Crisis and China
2009-06-16/a>	John Bambenek	Iran Internet Blackout: Using Twitter for Operational Intelligence
2009-06-16/a>	John Bambenek	URL Shortening Service Cligs Hacked
2009-06-11/a>	Rick Wanner	MIR-ROR Motile Incident Response - Respond Objectively Remediate
2009-06-10/a>	Rick Wanner	SysInternals Survey
2009-06-01/a>	G. N. White	Yet another "Digital Certificate" malware campaign
2009-05-24/a>	Raul Siles	Facebook phising using Belgium (.be) domains
2009-05-22/a>	Mark Hofman	Patching and Adobe
2009-05-22/a>	Mark Hofman	Patching and Apple - Java issue
2009-05-20/a>	Pedro Bueno	Cyber Warfare and Kylin thoughts
2009-05-19/a>	Bojan Zdrnja	Advanced blind SQL injection (with Oracle examples)
2009-05-11/a>	Mari Nichols	Sysinternals Updates 3 Applications
2009-05-09/a>	Patrick Nolan	Shared SQL Injection Lessons Learned blog item
2009-05-06/a>	Tom Liston	Follow The Bouncing Malware: Gone With the WINS
2009-05-04/a>	Tom Liston	Facebook phishing malware
2009-05-02/a>	Rick Wanner	More Swine/Mexican/H1N1 related domains
2009-05-01/a>	Adrien de Beaupre	Incident Management
2009-04-30/a>	Marcus Sachs	ARIN Notification Concerning IPv6
2009-04-28/a>	Deborah Hale	Updated List of Domains - Swineflu related
2009-04-27/a>	Johannes Ullrich	Swine Flu (Mexican Flu) related domains
2009-04-26/a>	Johannes Ullrich	Pandemic Preparation - Swine Flu
2009-04-24/a>	Pedro Bueno	Did you check your conference goodies?
2009-04-21/a>	Bojan Zdrnja	Web application vulnerabilities
2009-04-16/a>	Adrien de Beaupre	Incident Response vs. Incident Handling
2009-04-16/a>	Adrien de Beaupre	Strange Windows Event Log entry
2009-04-02/a>	Bojan Zdrnja	JavaScript insertion and log deletion attack tools
2009-03-27/a>	Mark Hofman	There is some SMiShing going on in the EU
2009-03-11/a>	Bojan Zdrnja	Massive ARP spoofing attacks on web sites
2009-03-10/a>	Swa Frantzen	TinyURL and security
2009-03-10/a>	Swa Frantzen	Browser plug-ins, transparent proxies and same origin policies
2009-03-02/a>	Swa Frantzen	Obama's leaked chopper blueprints: anything we can learn?
2009-02-25/a>	Swa Frantzen	Targeted link diversion attempts
2009-02-22/a>	Mari Nichols	The Internet Safety Act of 2009
2009-02-20/a>	Mark Hofman	Phishing with a small twist
2009-02-11/a>	Robert Danford	ProFTPd SQL Authentication Vulnerability exploit activity
2009-02-06/a>	Adrien de Beaupre	Time to patch your HP printers
2009-02-01/a>	Chris Carboni	Scanning for Trixbox vulnerabilities
2009-01-31/a>	Swa Frantzen	DNS DDoS - let's use a long term solution
2009-01-31/a>	Swa Frantzen	Windows 7 - not so secure ?
2009-01-31/a>	John Bambenek	Google Search Engine's Malware Detection Broken
2009-01-20/a>	Adrien de Beaupre	Obamamania
2009-01-18/a>	Maarten Van Horenbeeck	Targeted social engineering
2009-01-11/a>	Deborah Hale	The Frustration of Phishing Attacks
2009-01-08/a>	Kyle Haugsness	BIND OpenSSL follow-up
2009-01-07/a>	William Salusky	BIND 9.x security patch - resolves potentially new DNS poisoning vector
2009-01-04/a>	Rick Wanner	Twitter/Facebook Phishing Attempt
2009-01-02/a>	Rick Wanner	Tools on my Christmas list.
2008-12-28/a>	Raul Siles	Level3 Outage?
2008-12-17/a>	donald smith	Internet Explorer 960714 is released
2008-12-12/a>	Johannes Ullrich	MSIE 0-day Spreading Via SQL Injection
2008-12-12/a>	Swa Frantzen	Browser Security Handbook
2008-12-10/a>	Bojan Zdrnja	0-day exploit for Internet Explorer in the wild
2008-12-02/a>	Deborah Hale	Sonicwall License Manager Failure
2008-12-01/a>	Jason Lam	Input filtering and escaping in SQL injection mitigation
2008-11-25/a>	Andre Ludwig	The beginnings of a collaborative approach to IDS
2008-11-20/a>	Jason Lam	Large quantity SQL Injection mitigation
2008-11-14/a>	Stephen Hall	More updated tools
2008-11-12/a>	John Bambenek	Thoughts on Security Intelligence (McColo Corp alleged spam/malware host knocked offline)
2008-11-11/a>	Swa Frantzen	Phishing for Google adwords
2008-11-02/a>	Adrien de Beaupre	Daylight saving time
2008-10-31/a>	Rick Wanner	Sprint-Cogent Peering Issue
2008-10-30/a>	Kevin Liston	Making Intelligence Actionable: Part 2
2008-10-29/a>	Deborah Hale	Day 29 - Should I Switch Software Vendors?
2008-10-29/a>	Deborah Hale	Enom Phishing - Caution Enom Registrars
2008-10-20/a>	Johannes Ullrich	Fraudulent ATM Reactivation Phone Calls.
2008-10-18/a>	Rick Wanner	Updates to SysInternals tools!
2008-10-17/a>	Rick Wanner	Day 18 - Containing Other Incidents
2008-10-17/a>	Patrick Nolan	Day 17 - Containing a DNS Hijacking
2008-10-15/a>	Rick Wanner	Day 15 - Containing the Damage From a Lost or Stolen Laptop
2008-10-12/a>	Mari Nichols	Day 12 Containment: Gathering Evidence That Can be Used in Court
2008-10-10/a>	Marcus Sachs	Fake Microsoft Update Email
2008-10-08/a>	Johannes Ullrich	Domaincontrol (GoDaddy) Nameservers DNS Poisoning
2008-10-07/a>	Kyle Haugsness	Cogent peering problems
2008-10-01/a>	Rick Wanner	Handler Mailbag
2008-09-29/a>	Daniel Wesemann	ASPROX mutant
2008-09-22/a>	Jim Clausing	Lessons learned from the Palin (and other) account hijacks
2008-09-20/a>	Rick Wanner	New (to me) nmap Features
2008-09-16/a>	donald smith	Don't open that invoice.zip file its not from UPS
2008-09-11/a>	David Goldsmith	CookieMonster is coming to Pown (err, Town)
2008-09-09/a>	Swa Frantzen	wordpress upgrade
2008-09-01/a>	John Bambenek	The Number of Machines Controlled by Botnets Has Jumped 4x in Last 3 Months
2008-08-23/a>	Mark Hofman	SQL injections - an update
2008-08-15/a>	Jim Clausing	OMFW 2008 reflections
2008-08-14/a>	Johannes Ullrich	DNSSEC for DShield.org
2008-08-12/a>	Johannes Ullrich	Upcoming Infocon Test and new Color
2008-08-08/a>	Mark Hofman	More SQL Injections - very active right now
2008-08-02/a>	Maarten Van Horenbeeck	A little of that human touch
2008-08-02/a>	Swa Frantzen	BIND: -P2 patches are released
2008-07-31/a>	Swa Frantzen	Linus - Linux and Security - follow-up
2008-07-29/a>	Swa Frantzen	Linus - Linux and Security
2008-07-24/a>	Bojan Zdrnja	What's brewing in Danmec's pot?
2008-07-24/a>	Kyle Haugsness	DNS cache poisoning vulnerability details confirmed
2008-07-11/a>	Jim Clausing	And you thought the DNS issue was an old one...
2008-07-08/a>	Johannes Ullrich	Mulitple Vendors DNS Spoofing Vulnerability
2008-07-07/a>	Pedro Bueno	Bad url classification
2008-07-02/a>	Jim Clausing	Another little script I threw together
2008-06-30/a>	Marcus Sachs	More SQL Injection with Fast Flux hosting
2008-06-25/a>	Deborah Hale	Report of Coreflood.dr Infection
2008-06-24/a>	Jason Lam	Microsoft SQL Injection Prevention Strategy
2008-06-24/a>	Jason Lam	SQL Injection mitigation in ASP
2008-06-23/a>	donald smith	Preventing SQL injection
2008-06-18/a>	Marcus Sachs	Olympics Part II
2008-06-17/a>	Kyle Haugsness	Why go high-tech?
2008-06-13/a>	Johannes Ullrich	SQL Injection: More of the same
2008-06-12/a>	Bojan Zdrnja	Safari on Windows - not looking good
2008-06-10/a>	Swa Frantzen	Linux ASN.1 BER kernel buffer overflow
2008-06-02/a>	Jim Clausing	Emergingthreats.net and ThePlanet
2008-06-01/a>	Mark Hofman	Free Yahoo email account! Sign me up, Ok well maybe not.
2008-05-26/a>	Marcus Sachs	Predictable Response
2008-05-20/a>	Raul Siles	List of malicious domains inserted through SQL injection
2008-05-19/a>	Maarten Van Horenbeeck	Text message and telephone aid scams
2008-05-17/a>	Lorna Hutcheson	XP SP3 Issues
2008-05-13/a>	Swa Frantzen	OpenSSH: Predictable PRNG in debian and ubuntu Linux
2008-05-06/a>	John Bambenek	Windows XP Service Pack 3 Released
2008-05-01/a>	Adrien de Beaupre	Windows XP SteadyState
2008-04-29/a>	Bojan Zdrnja	Windows Service Pack blocker tool
2008-04-24/a>	donald smith	Hundreds of thousands of SQL injections
2008-04-18/a>	John Bambenek	The Patch Window is Gone: Automated Patch-Based Exploit Generation
2008-04-16/a>	Bojan Zdrnja	The 10.000 web sites infection mystery solved
2008-04-16/a>	William Stearns	Windows XP Service Pack 3 - unofficial schedule: Apr 21-28
2008-04-16/a>	William Stearns	Passer, a aassive machine and service sniffer
2008-04-14/a>	John Bambenek	A Federal Subpoena or Just Some More Spam & Malware?
2008-04-11/a>	John Bambenek	ADSL Router / Cable Modem / Home Wireless AP Hardening in 5 Steps
2008-04-07/a>	John Bambenek	HP USB Keys Shipped with Malware for your Proliant Server
2008-03-27/a>	Pedro Bueno	Freedom of Speech...or not?
2008-03-27/a>	Maarten Van Horenbeeck	Guarding the guardians: a story of PGP key ring theft
2008-03-21/a>	donald smith	D-Link router based worm?
2008-03-14/a>	Kevin Liston	2117966.net-- mass iframe injection
2008-03-13/a>	Jason Lam	Remote File Include spoof!?
2008-03-12/a>	Joel Esler	Don't use G-Archiver
2008-03-12/a>	Joel Esler	Adobe security updates
2008-01-09/a>	Bojan Zdrnja	Mass exploits with SQL Injection
2007-02-24/a>	Jason Lam	Prepared Statements and SQL injections
2007-01-03/a>	Toby Kohlenberg	VLC Media Player udp URL handler Format String Vulnerability
2006-12-12/a>	Swa Frantzen	Offline Microsoft Patching
2006-10-05/a>	John Bambenek	There are no more Passive Exploits
2006-10-02/a>	Jim Clausing	Back to green, but the exploits are still running wild
2006-09-28/a>	Swa Frantzen	Powerpoint, yet another new vulnerability
2006-09-06/a>	Johannes Ullrich	Updated Packet Attack flash animation
MEMORY
2024-08-29/a>	Xavier Mertens	Live Patching DLLs with Python
2020-07-27/a>	Johannes Ullrich	In Memory of Donald Smith
2020-06-04/a>	Xavier Mertens	Anti-Debugging Technique based on Memory Protection
2016-10-30/a>	Pasquale Stirparo	Volatility Bot: Automated Memory Analysis
2015-05-03/a>	Russ McRee	VolDiff, for memory image differential analysis
2015-04-24/a>	Basil Alawi S.Taher	Fileless Malware
2015-04-17/a>	Didier Stevens	Memory Forensics Of Network Devices
2014-08-27/a>	Rob VandenBrink	One More Day of Trolling in POS Memory
2014-03-11/a>	Basil Alawi S.Taher	Introduction to Memory Analysis with Mandiant Redline
2014-03-07/a>	Tom Webb	Linux Memory Dump with Rekall
2013-12-12/a>	Basil Alawi S.Taher	Acquiring Memory Images with Dumpit
2013-05-23/a>	Adrien de Beaupre	MoVP II
2013-01-03/a>	Bojan Zdrnja	Memory acquisition traps
2012-09-19/a>	Kevin Liston	Volatility: 2.2 is Coming Soon
2012-05-07/a>	Guy Bruneau	iOS 5.1.1 Software Update for iPod, iPhone, iPad
2010-04-02/a>	Guy Bruneau	Firefox 3.6.3 fix for CVE-2010-1121 http://www.mozilla.org/security/announce/2010/mfsa2010-25.html
2009-07-26/a>	Jim Clausing	New Volatility plugins
2009-02-05/a>	Rick Wanner	Mandiant Memoryze review, Hilighter, other Mandiant tools!
2009-01-02/a>	Rick Wanner	Tools on my Christmas list.
2008-12-13/a>	Jim Clausing	Followup from last shift and some research to do.
2008-11-22/a>	G. N. White	Picture Printing Kiosks & Flash Memory Devices
2008-11-17/a>	Jim Clausing	Finding stealth injected DLLs

IN MEMORY

IN

MEMORY