Diaries by Keyword - SANS Internet Storm Center

Handler on Duty: Xavier Mertens

Threat Level: green

Date	Author	Title
LOG ANALYSIS
2024-05-28	Guy Bruneau	Is that It? Finding the Unknown: Correlations Between Honeypot Logs & PCAPs [Guest Diary]
2023-01-21	Guy Bruneau	DShield Sensor JSON Log to Elasticsearch
2021-04-10	Guy Bruneau	Building an IDS Sensor with Suricata & Zeek with Logs to ELK
2021-01-30	Guy Bruneau	PacketSifter as Network Parsing and Telemetry Tool
2020-10-01	Daniel Wesemann	Making sense of Azure AD (AAD) activity logs
2017-07-09	Russ McRee	Adversary hunting with SOF-ELK
2014-04-21	Daniel Wesemann	Finding the bleeders
2014-03-13	Daniel Wesemann	Web server logs containing RS=^ ?
2014-01-14	Chris Mohan	Spamming and scanning botnets - is there something I can do to block them from my site?
2012-12-02	Guy Bruneau	Collecting Logs from Security Devices at Home
LOG
2024-09-17/a>	Xavier Mertens	23:59, Time to Exfiltrate!
2024-07-24/a>	Xavier Mertens	"Mouse Logger" Malicious Python Script
2024-05-28/a>	Guy Bruneau	Is that It? Finding the Unknown: Correlations Between Honeypot Logs & PCAPs [Guest Diary]
2024-05-08/a>	Xavier Mertens	Analyzing Synology Disks on Linux
2024-03-29/a>	Xavier Mertens	Quick Forensics Analysis of Apache logs
2024-02-08/a>	Xavier Mertens	A Python MP3 Player with Builtin Keylogger Capability
2023-12-23/a>	Xavier Mertens	Python Keylogger Using Mailtrap.io
2023-12-10/a>	Guy Bruneau	Honeypots: From the Skeptical Beginner to the Tactical Enthusiast
2023-11-20/a>	Jesse La Grew	Overflowing Web Honeypot Logs
2023-08-31/a>	Guy Bruneau	Potential Weaponizing of Honeypot Logs [Guest Diary]
2023-07-23/a>	Guy Bruneau	Install & Configure Filebeat on Raspberry Pi ARM64 to Parse DShield Sensor Logs
2023-05-14/a>	Guy Bruneau	DShield Sensor Update
2023-04-18/a>	Johannes Ullrich	UDDIs are back? Attackers rediscovering old exploits.
2023-04-08/a>	Xavier Mertens	Microsoft Netlogon: Potential Upcoming Impacts of CVE-2022-38023
2023-02-10/a>	Xavier Mertens	Obfuscated Deactivation of Script Block Logging
2023-01-21/a>	Guy Bruneau	DShield Sensor JSON Log to Elasticsearch
2023-01-08/a>	Guy Bruneau	DShield Sensor JSON Log Analysis
2022-12-21/a>	Guy Bruneau	DShield Sensor Setup in Azure
2022-07-20/a>	Xavier Mertens	Malicious Python Script Behaving Like a Rubber Ducky
2022-04-25/a>	Xavier Mertens	Simple PDF Linking to Malicious Content
2022-04-05/a>	Johannes Ullrich	WebLogic Crypto Miner Malware Disabling Alibaba Cloud Monitoring Tools
2022-02-23/a>	Johannes Ullrich	The Rise and Fall of log4shell
2022-01-29/a>	Guy Bruneau	SIEM In this Decade, Are They Better than the Last?
2022-01-17/a>	Johannes Ullrich	Log4Shell Attacks Getting "Smarter"
2021-12-29/a>	Russ McRee	Log4j 2 Security Vulnerabilities Update Guide
2021-12-23/a>	Johannes Ullrich	log4shell and cloud provider internal meta data services (IMDS)
2021-12-23/a>	Johannes Ullrich	Defending Cloud IMDS Against log4shell (and more)
2021-12-14/a>	Johannes Ullrich	Log4j: Getting ready for the long haul (CVE-2021-44228)
2021-12-11/a>	Johannes Ullrich	Log4j / Log4Shell Followup: What we see and how to defend (and how to access our data)
2021-12-10/a>	Bojan Zdrnja	RCE in log4j, Log4Shell, or how things can get bad quickly
2021-10-11/a>	Johannes Ullrich	Things that go "Bump" in the Night: Non HTTP Requests Hitting Web Servers
2021-10-09/a>	Guy Bruneau	Scanning for Previous Oracle WebLogic Vulnerabilities
2021-09-11/a>	Guy Bruneau	Shipping to Elasticsearch Microsoft DNS Logs
2021-06-11/a>	Xavier Mertens	Keeping an Eye on Dangerous Python Modules
2021-04-10/a>	Guy Bruneau	Building an IDS Sensor with Suricata & Zeek with Logs to ELK
2021-03-18/a>	Xavier Mertens	Simple Python Keylogger
2021-03-12/a>	Guy Bruneau	Microsoft DHCP Logs Shipped to ELK
2021-02-13/a>	Guy Bruneau	Using Logstash to Parse IPtables Firewall Logs
2021-01-30/a>	Guy Bruneau	PacketSifter as Network Parsing and Telemetry Tool
2020-11-07/a>	Guy Bruneau	Cryptojacking Targeting WebLogic TCP/7001
2020-10-29/a>	Johannes Ullrich	PATCH NOW: CVE-2020-14882 Weblogic Actively Exploited Against Honeypots
2020-10-01/a>	Daniel Wesemann	Making sense of Azure AD (AAD) activity logs
2020-08-14/a>	Jan Kopriva	Definition of 'overkill' - using 130 MB executable to hide 24 kB malware
2020-07-27/a>	Johannes Ullrich	In Memory of Donald Smith
2020-07-23/a>	Xavier Mertens	Simple Blocklisting with MISP & pfSense
2020-02-12/a>	Rob VandenBrink	March Patch Tuesday is Coming - the LDAP Changes will Change Your Life!
2020-01-25/a>	Guy Bruneau	Is Threat Hunting the new Fad?
2020-01-12/a>	Guy Bruneau	ELK Dashboard and Logstash parser for tcp-honeypot Logs
2019-12-07/a>	Guy Bruneau	Integrating Pi-hole Logs in ELK with Logstash
2019-10-30/a>	Xavier Mertens	Keep an Eye on Remote Access to Mailboxes
2019-09-17/a>	Rob VandenBrink	Investigating Gaps in your Windows Event Logs
2019-06-19/a>	Johannes Ullrich	Critical Actively Exploited WebLogic Flaw Patched CVE-2019-2729
2019-06-06/a>	Xavier Mertens	Keep an Eye on Your WMI Logs
2019-05-19/a>	Guy Bruneau	Is Metadata Only Approach, Good Enough for Network Traffic Analysis?
2019-04-28/a>	Johannes Ullrich	Update about Weblogic CVE-2019-2725 (Exploits Used in the Wild, Patch Status)
2019-04-25/a>	Rob VandenBrink	Unpatched Vulnerability Alert - WebLogic Zero Day
2019-02-21/a>	Xavier Mertens	Simple Powershell Keyloggers are Back
2019-02-18/a>	Didier Stevens	Know What You Are Logging
2019-02-07/a>	Xavier Mertens	Phishing Kit with JavaScript Keylogger
2018-07-20/a>	Kevin Liston	Weblogic Exploit Code Made Public (CVE-2018-2893)
2018-07-17/a>	Xavier Mertens	Searching for Geographically Improbable Login Attempts
2018-06-21/a>	Xavier Mertens	Are Your Hunting Rules Still Working?
2018-06-19/a>	Xavier Mertens	PowerShell: ScriptBlock Logging... Or Not?
2018-06-06/a>	Xavier Mertens	Converting PCAP Web Traffic to Apache Log
2018-05-03/a>	Renato Marinho	WebLogic Exploited in the Wild (Again)
2018-01-07/a>	Guy Bruneau	SSH Scans by Clients Types
2017-09-29/a>	Lorna Hutcheson	Good Analysis = Understanding(tools + logs + normal)
2017-07-09/a>	Russ McRee	Adversary hunting with SOF-ELK
2017-04-20/a>	Xavier Mertens	DNS Query Length... Because Size Does Matter
2016-12-27/a>	Guy Bruneau	Using daemonlogger as a Software Tap
2016-08-29/a>	Russ McRee	Recommended Reading: Intrusion Detection Using Indicators of Compromise Based on Best Practices and Windows Event Logs
2016-06-01/a>	Xavier Mertens	Docker Containers Logging
2015-07-31/a>	Russ McRee	Tech tip follow-up: Using the data Invoked with R's system command
2015-07-31/a>	Russ McRee	Tech tip: Invoke a system command in R
2015-06-01/a>	Tom Webb	Submit Dshield ASA Logs
2015-05-20/a>	Brad Duncan	Logjam - vulnerabilities in Diffie-Hellman key exchange affect browsers and servers using TLS
2015-04-23/a>	Bojan Zdrnja	When automation does not help
2015-03-11/a>	Rob VandenBrink	Syslog Skeet Shooting - Targetting Real Problems in Event Logs
2014-09-27/a>	Guy Bruneau	What has Bash and Heartbleed Taught Us?
2014-09-22/a>	Johannes Ullrich	Fake LogMeIn Certificate Update with Bad AV Detection Rate
2014-08-15/a>	Tom Webb	AppLocker Event Logs with OSSEC 2.8
2014-08-05/a>	Johannes Ullrich	Synolocker: Why OFFLINE Backups are important
2014-04-21/a>	Daniel Wesemann	Finding the bleeders
2014-04-04/a>	Rob VandenBrink	Dealing with Disaster - A Short Malware Incident Response
2014-04-01/a>	Johannes Ullrich	cmd.so Synology Scanner Also Found on Routers
2014-03-31/a>	Johannes Ullrich	More Device Malware: This is why your DVR attacked my Synology Disk Station (and now with Bitcoin Miner!)
2014-03-28/a>	Johannes Ullrich	War of the Bots: When DVRs attack NASs
2014-03-26/a>	Johannes Ullrich	Let's Finally "Nail" This Port 5000 Traffic - Synology owners needed.
2014-03-13/a>	Daniel Wesemann	Web server logs containing RS=^ ?
2014-02-14/a>	Chris Mohan	Scanning activity for /siemens/bootstrapping/JnlpBrowser/Development/
2014-02-09/a>	Basil Alawi S.Taher	Mandiant Highlighter 2
2014-01-27/a>	Basil Alawi S.Taher	Log Parsing with Mandiant Highlighter (1)
2014-01-14/a>	Chris Mohan	Spamming and scanning botnets - is there something I can do to block them from my site?
2014-01-04/a>	Tom Webb	Monitoring Windows Networks Using Syslog (Part One)
2013-12-03/a>	Rob VandenBrink	Even in the Quietest Moments ...
2013-11-16/a>	Guy Bruneau	Sagan as a Log Normalizer
2013-10-10/a>	Mark Hofman	CSAM Some more unusual scans
2013-09-24/a>	Tom Webb	IDS, NSM, and Log Management with Security Onion 12.04.3
2013-09-11/a>	Alex Stanford	Getting Started with Rsyslog Filters
2013-09-02/a>	Guy Bruneau	Snort IDS Sensor with Sguil New ISO Released
2013-08-21/a>	Alex Stanford	Psst. Your Browser Knows All Your Secrets.
2013-02-28/a>	Daniel Wesemann	Parsing Windows Eventlogs in Powershell
2013-02-27/a>	Adam Swanger	Guest Diary: Dylan Johnson - There's value in them there logs!
2013-02-22/a>	Chris Mohan	PHP 5.4.12 and PHP 5.3.22 released http://www.php.net/ChangeLog-5.php
2013-02-17/a>	Guy Bruneau	HP ArcSight Connector Appliance and Logger Vulnerabilities
2013-02-06/a>	Johannes Ullrich	Are you losing system logging information (and don't know it)?
2012-12-02/a>	Guy Bruneau	Collecting Logs from Security Devices at Home
2012-07-13/a>	Russ McRee	2 for 1: SANSFIRE & MSRA presentations
2012-07-11/a>	Rick Wanner	Excellent Security Education Resources
2012-05-02/a>	Bojan Zdrnja	Monitoring VMWare logs
2012-04-08/a>	Chris Mohan	Blog Log: More noise or a rich source of intelligence?
2011-11-19/a>	Kevin Liston	Monitoring your Log Monitoring Process
2011-06-21/a>	Chris Mohan	Australian government security audit report shows tough love to agencies
2011-06-20/a>	Chris Mohan	Log files - are you reviewing yours?
2011-05-17/a>	Johannes Ullrich	A Couple Days of Logs: Looking for the Russian Business Network
2011-03-29/a>	Daniel Wesemann	Making sense of RSA ACE server audit logs
2011-03-11/a>	Guy Bruneau	Snort IDS Sensor with Sguil Framework ISO
2011-01-24/a>	Rob VandenBrink	Where have all the COM Ports Gone? - How enumerating COM ports led to me finding a “misplaced” Microsoft tool
2010-12-24/a>	Daniel Wesemann	A question of class
2010-09-28/a>	Daniel Wesemann	Supporting the economy (in Russia and Ukraine)
2010-07-24/a>	Manuel Humberto Santander Pelaez	Transmiting logon information unsecured in the network
2010-04-06/a>	Daniel Wesemann	Application Logs
2010-03-10/a>	Rob VandenBrink	What's My Firewall Telling Me? (Part 4)
2010-03-05/a>	Kyle Haugsness	What is your firewall log telling you - responses
2010-02-23/a>	Mark Hofman	What is your firewall telling you and what is TCP249?
2010-02-06/a>	Guy Bruneau	Oracle WebLogic Server Security Alert
2010-01-29/a>	Johannes Ullrich	Analyzing isc.sans.org weblogs, part 2, RFI attacks
2010-01-20/a>	Johannes Ullrich	Weathering the Storm Part 1: An analysis of our SANS ISC weblogs http://appsecstreetfighter.com
2009-10-26/a>	Johannes Ullrich	Web honeypot Update
2009-10-26/a>	Johannes Ullrich	Today: ISC Login bugfix day. If you have issues logging in using OpenID, please email a copy of your OpenID URL to jullrich\at\sans.edu
2009-04-16/a>	Adrien de Beaupre	Strange Windows Event Log entry
2009-04-09/a>	Johannes Ullrich	Conficker update with payload
2009-03-26/a>	Mark Hofman	Webhoneypot fun
2009-01-09/a>	Johannes Ullrich	SANS Log Management Survey
2008-11-05/a>	donald smith	If you missed President Elect Obamas speech have some malware instead
2008-08-19/a>	Johannes Ullrich	A morning stroll through my web logs
2008-08-05/a>	Daniel Wesemann	Watching those DNS logs
2006-10-02/a>	Jim Clausing	Reader's tip of the day: ratios vs. raw counts
2006-09-18/a>	Jim Clausing	Log analysis follow up
2006-09-09/a>	Jim Clausing	Log Analysis tips?
2006-09-09/a>	Jim Clausing	A few preliminary log analysis thoughts
ANALYSIS
2024-10-17/a>	Guy Bruneau	Scanning Activity from Subnet 15.184.0.0/16
2024-09-25/a>	Guy Bruneau	OSINT - Image Analysis or More Where, When, and Metadata [Guest Diary]
2024-09-18/a>	Guy Bruneau	Time-to-Live Analysis of DShield Data with Vega-Lite
2024-09-11/a>	Guy Bruneau	Hygiene, Hygiene, Hygiene! [Guest Diary]
2024-08-27/a>	Guy Bruneau	Vega-Lite with Kibana to Parse and Display IP Activity over Time
2024-08-16/a>	Jesse La Grew	[Guest Diary] 7 minutes and 4 steps to a quick win: A write-up on custom tools
2024-06-13/a>	Guy Bruneau	The Art of JQ and Command-line Fu [Guest Diary]
2024-05-28/a>	Guy Bruneau	Is that It? Finding the Unknown: Correlations Between Honeypot Logs & PCAPs [Guest Diary]
2024-04-29/a>	Guy Bruneau	Linux Trojan - Xorddos with Filename eyshcjdmzg
2024-03-29/a>	Xavier Mertens	Quick Forensics Analysis of Apache logs
2024-02-25/a>	Guy Bruneau	Utilizing the VirusTotal API to Query Files Uploaded to DShield Honeypot [Guest Diary]
2024-02-03/a>	Guy Bruneau	DShield Sensor Log Collection with Elasticsearch
2023-11-17/a>	Jan Kopriva	Phishing page with trivial anti-analysis features
2023-02-04/a>	Guy Bruneau	Assemblyline as a Malware Analysis Sandbox
2023-01-21/a>	Guy Bruneau	DShield Sensor JSON Log to Elasticsearch
2023-01-08/a>	Guy Bruneau	DShield Sensor JSON Log Analysis
2022-07-29/a>	Johannes Ullrich	PDF Analysis Intro and OpenActions Entries
2022-07-18/a>	Didier Stevens	Adding Your Own Keywords To My PDF Tools
2022-06-01/a>	Jan Kopriva	HTML phishing attachments - now with anti-analysis features
2021-04-10/a>	Guy Bruneau	Building an IDS Sensor with Suricata & Zeek with Logs to ELK
2021-04-06/a>	Jan Kopriva	Malspam with Lokibot vs. Outlook and RFCs
2021-01-30/a>	Guy Bruneau	PacketSifter as Network Parsing and Telemetry Tool
2021-01-14/a>	Bojan Zdrnja	Dynamically analyzing a heavily obfuscated Excel 4 macro malicious file
2020-12-03/a>	Brad Duncan	Traffic Analysis Quiz: Mr Natural
2020-11-11/a>	Brad Duncan	Traffic Analysis Quiz: DESKTOP-FX23IK5
2020-10-01/a>	Daniel Wesemann	Making sense of Azure AD (AAD) activity logs
2020-09-20/a>	Guy Bruneau	Analysis of a Salesforce Phishing Emails
2020-06-01/a>	Jim Clausing	Stackstrings, type 2
2020-05-02/a>	Guy Bruneau	Phishing PDF with Unusual Hostname
2020-01-25/a>	Guy Bruneau	Is Threat Hunting the new Fad?
2020-01-12/a>	Guy Bruneau	ELK Dashboard and Logstash parser for tcp-honeypot Logs
2019-12-29/a>	Guy Bruneau	ELK Dashboard for Pihole Logs
2019-12-07/a>	Guy Bruneau	Integrating Pi-hole Logs in ELK with Logstash
2019-11-23/a>	Guy Bruneau	Local Malware Analysis with Malice
2019-10-18/a>	Xavier Mertens	Quick Malicious VBS Analysis
2019-06-27/a>	Rob VandenBrink	Finding the Gold in a Pile of Pennies - Long Tail Analysis in PowerShell
2019-06-14/a>	Jim Clausing	A few Ghidra tips for IDA users, part 4 - function call graphs
2019-04-17/a>	Jim Clausing	A few Ghidra tips for IDA users, part 2 - strings and parameters
2019-04-08/a>	Jim Clausing	A few Ghidra tips for IDA users, part 1 - the decompiler/unreachable code
2019-04-03/a>	Jim Clausing	A few Ghidra tips for IDA users, part 0 - automatic comments for API call parameters
2019-03-31/a>	Didier Stevens	Maldoc Analysis of the Weekend by a Reader
2019-02-27/a>	Didier Stevens	Maldoc Analysis by a Reader
2018-11-18/a>	Guy Bruneau	Multipurpose PCAP Analysis Tool
2018-10-21/a>	Pasquale Stirparo	Beyond good ol’ LaunchAgent - part 0
2018-08-31/a>	Jim Clausing	Quickie: Using radare2 to disassemble shellcode
2018-06-01/a>	Remco Verhoef	Binary analysis with Radare2
2017-09-29/a>	Lorna Hutcheson	Good Analysis = Understanding(tools + logs + normal)
2017-07-09/a>	Russ McRee	Adversary hunting with SOF-ELK
2017-04-28/a>	Russell Eubanks	KNOW before NO
2017-01-28/a>	Lorna Hutcheson	Packet Analysis - Where do you start?
2016-12-24/a>	Didier Stevens	Pinging All The Way
2016-10-30/a>	Pasquale Stirparo	Volatility Bot: Automated Memory Analysis
2016-10-17/a>	Didier Stevens	Maldoc VBA Anti-Analysis: Video
2016-10-15/a>	Didier Stevens	Maldoc VBA Anti-Analysis
2016-05-14/a>	Guy Bruneau	INetSim as a Basic Honeypot
2016-04-21/a>	Daniel Wesemann	Decoding Pseudo-Darkleech (Part #2)
2015-05-03/a>	Russ McRee	VolDiff, for memory image differential analysis
2014-07-05/a>	Guy Bruneau	Malware Analysis with pedump
2014-04-21/a>	Daniel Wesemann	Finding the bleeders
2014-03-13/a>	Daniel Wesemann	Web server logs containing RS=^ ?
2014-01-14/a>	Chris Mohan	Spamming and scanning botnets - is there something I can do to block them from my site?
2013-10-28/a>	Daniel Wesemann	Exploit cocktail (Struts, Java, Windows) going after 3-month old vulnerabilities
2013-06-18/a>	Russ McRee	Volatility rules...any questions?
2013-05-11/a>	Lenny Zeltser	Extracting Digital Signatures from Signed Malware
2013-03-09/a>	Guy Bruneau	IPv6 Focus Month: IPv6 Encapsulation - Protocol 41
2013-02-03/a>	Lorna Hutcheson	Is it Really an Attack?
2013-01-08/a>	Jim Clausing	Cuckoo 0.5 is out and the world didn't end
2012-12-02/a>	Guy Bruneau	Collecting Logs from Security Devices at Home
2012-09-19/a>	Kevin Liston	Volatility: 2.2 is Coming Soon
2012-09-14/a>	Lenny Zeltser	Analyzing Malicious RTF Files Using OfficeMalScanner's RTFScan
2012-06-21/a>	Russ McRee	Analysis of drive-by attack sample set
2012-06-04/a>	Lenny Zeltser	Decoding Common XOR Obfuscation in Malicious Code
2012-05-23/a>	Mark Baggett	IP Fragmentation Attacks
2012-03-03/a>	Jim Clausing	New automated sandbox for Android malware
2012-02-07/a>	Jim Clausing	Book Review: Practical Packet Analysis, 2nd ed
2011-05-20/a>	Guy Bruneau	Sysinternals Updates, Analyzing Stuxnet Infection with Sysinternals Tools Part 3
2011-04-14/a>	Adrien de Beaupre	Sysinternals updates, a new blog post, and webcast
2011-02-01/a>	Lenny Zeltser	The Importance of HTTP Headers When Investigating Malicious Sites
2010-08-09/a>	Jim Clausing	Free/inexpensive tools for monitoring systems/networks
2010-07-21/a>	Adrien de Beaupre	autorun.inf and .lnk Malware (NOT 'Vulnerability in Windows Shell Could Allow Remote Code Execution' 2286198)
2010-05-26/a>	Bojan Zdrnja	Malware modularization and AV detection evasion
2010-04-11/a>	Marcus Sachs	Network and process forensics toolset
2010-03-26/a>	Daniel Wesemann	Getting the EXE out of the RTF again
2010-02-13/a>	Lorna Hutcheson	Network Traffic Analysis in Reverse
2010-01-14/a>	Bojan Zdrnja	PDF Babushka
2010-01-07/a>	Daniel Wesemann	Static analysis of malicious PDFs
2010-01-07/a>	Daniel Wesemann	Static analysis of malicous PDFs (Part #2)
2009-11-25/a>	Jim Clausing	Updates to my GREM Gold scripts and a new script
2009-11-03/a>	Bojan Zdrnja	Opachki, from (and to) Russia with love
2009-09-25/a>	Lenny Zeltser	Categories of Common Malware Traits
2009-07-26/a>	Jim Clausing	New Volatility plugins
2009-07-02/a>	Daniel Wesemann	Getting the EXE out of the RTF
2009-04-15/a>	Marcus Sachs	2009 Data Breach Investigation Report
2009-03-13/a>	Bojan Zdrnja	When web application security, Microsoft and the AV vendors all fail
2009-02-10/a>	Bojan Zdrnja	More tricks from Conficker and VM detection
2009-02-09/a>	Bojan Zdrnja	Some tricks from Conficker's bag
2009-01-18/a>	Daniel Wesemann	3322. org
2009-01-15/a>	Bojan Zdrnja	Conficker's autorun and social engineering
2009-01-07/a>	Bojan Zdrnja	An Israeli patriot program or a trojan
2009-01-02/a>	Rick Wanner	Tools on my Christmas list.
2008-12-13/a>	Jim Clausing	Followup from last shift and some research to do.
2008-11-17/a>	Marcus Sachs	New Tool: NetWitness Investigator
2008-11-17/a>	Jim Clausing	Finding stealth injected DLLs
2008-09-03/a>	Daniel Wesemann	Static analysis of Shellcode - Part 2
2008-07-07/a>	Pedro Bueno	Bad url classification
2006-10-02/a>	Jim Clausing	Reader's tip of the day: ratios vs. raw counts
2006-09-18/a>	Jim Clausing	Log analysis follow up
2006-09-09/a>	Jim Clausing	Log Analysis tips?
2006-09-09/a>	Jim Clausing	A few preliminary log analysis thoughts

LOG ANALYSIS

LOG

ANALYSIS