Tag: SANS Internet Storm Center, InfoCON: green

[Guest Diary] Insights from August Web Traffic Surge, (Wed, Nov 6th)

[This is a Guest Diary by Trevor Coleman, an ISC intern as part of the SANS.edu Bachelor's Degree in Applied Cybersecurity (BACS) program [1]. This article has been indexed from SANS Internet Storm Center, InfoCON: green Read the original article:…

Read more →

Python RAT with a Nice Screensharing Feature, (Tue, Nov 5th)

While hunting, I found another interesting Python RAT in the wild. This is not brand new because the script was released two years ago[1]. The script I found is based on the same tool and still has a low VT score:…

Read more →

Analyzing an Encrypted Phishing PDF, (Mon, Nov 4th)

Once in a while, I get a question about my pdf-parser.py tool, not able to decode strings and streams from a PDF document. This article has been indexed from SANS Internet Storm Center, InfoCON: green Read the original article: Analyzing…

Read more →

qpdf: Extracting PDF Streams, (Sat, Nov 2nd)

In diary entry “Analyzing PDF Streams” I answer a question asked by a student of Xavier: “how can you export all streams of a PDF?”. I explained how to do this with my pdf-parser.py tool. This article has been indexed…

Read more →

Scans for RDP Gateways, (Wed, Oct 30th)

RDP is one of the most prominent entry points into networks. Ransomware actors have taken down many large networks after initially entering via RDP. Credentials for RDP access are often traded by “initial access brokers”. This article has been indexed…

Read more →