Use of X-Frame-Options and CSP frame-ancestors security headers on 1 million most popular domains, (Fri, Mar 31st)
In my last Diary[1], I shortly mentioned the need for correctly set Content Security Policy…
ISC Stormcast For Friday, March 31st, 2023 https://isc.sans.edu/podcastdetail.html?id=8434, (Fri, Mar 31st)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
Bypassing PowerShell Strong Obfuscation, (Thu, Mar 30th)
Yesterday, I found a malicious PowerShell script that was heavily obfuscated. The filename is “B0A4.ps1"[1]…
ISC Stormcast For Thursday, March 30th, 2023, (Thu, Mar 30th)
https://isc.sans.edu/podcastdetail.html?id=8432 (c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
Extracting Multiple Streams From OLE Files, (Wed, Mar 29th)
Reader Martin asks us for some help extracting embedded content from a submitted malicious document.…
ISC Stormcast For Wednesday, March 29th, 2023, (Wed, Mar 29th)
https://isc.sans.edu/podcastdetail.html?id=8430 (c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
Network Data Collector Placement Makes a Difference, (Tue, Mar 28th)
A previous diary [1] described processing some local PCAP data with Zeek. This data was…
ISC Stormcast For Tuesday, March 28th, 2023, (Tue, Mar 28th)
https://isc.sans.edu/podcastdetail.html?id=8428 (c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
Apple Updates Everything (including Studio Display), (Mon, Mar 27th)
Apple today released updates for all of its operating systems. The updates also apply for…
Another Malicious HTA File Analysis – Part 1, (Mon, Mar 27th)
In this series of diary entries, I will analyze an HTA file I found on…