Category: SANS Full Feed

For most system and network administrators, the free SSH client Putty has been their best friend for years! This tool was also (ab)used by attackers that deployed a trojanized version[1]. Microsoft had the good idea to include OpenSSH (beta version) in Windows 10 Fall Creators Update. One year later, it became a default component with Windows…

Read More

While hunting, I found an interesting picture. It’s a PNG file that was concatenated with two interesting payloads. There are file formats that are good candidates to have data added at the end of the file. PNG is the case because the file format specifications says: “One notable restriction is that IHDR must appear first and IEND must appear…

Read More

DShield honeypots [1] receive different types of attack traffic and the volume of that traffic can change over time. I’ve been collecting data from a half dozen honeypots for a little over a year to make comparisons. This data includes: Cowrie logs [2], which contain SSH and telnet attacks Web honeypot logs Firewall logs (iptables)…

Read More

[This is a Guest Diary by Ehsaan Mavani, an ISC intern as part of the SANS.edu BACS program] Introduction Adversaries are leveraging alternate data streams to hide malicious data with the intent of evading detection. Numerous different malicious software has been designed to read and write to alternate data streams [1]. To better assist in…

Read More

[This is a Guest Diary by Jennifer Wilson, an ISC intern as part of the SANS.edu Bachelor’s Degree in Applied Cybersecurity (BACS) program [1].] As part of my BACS internship with SANS, I setup and maintained a DShield honeypot instance using a physical Raspberry Pi device.  As I was putting together each of my attack…

Read More