WINDOWS 10 |
| 2017-01-18 | Rob VandenBrink | Making Windows 10 a bit less "Creepy" - Common Privacy Settings |
| 2016-11-18 | Didier Stevens | VBA Shellcode and Windows 10 |
| 2016-01-31 | Guy Bruneau | Windows 10 and System Protection for DATA Default is OFF |
WINDOWS |
| 2022-06-26/a> | Didier Stevens | My Paste Command |
| 2022-06-24/a> | Xavier Mertens | Python (ab)using The Windows GUI |
| 2022-04-28/a> | Johannes Ullrich | A Day of SMB: What does our SMB/RPC Honeypot see? CVE-2022-26809 |
| 2022-04-14/a> | Johannes Ullrich | An Update on CVE-2022-26809 - MSRPC Vulnerabliity - PATCH NOW |
| 2022-04-06/a> | Brad Duncan | Windows MetaStealer Malware |
| 2022-02-25/a> | Didier Stevens | Windows, Fixed IPv4 Addresses and APIPA |
| 2021-10-14/a> | Xavier Mertens | Port-Forwarding with Windows for the Win |
| 2021-07-21/a> | Johannes Ullrich | "Summer of SAM": Microsoft Releases Guidance for CVE-2021-36934 |
| 2021-07-19/a> | Rick Wanner | New Windows Print Spooler Vulnerability - CVE-2021-34481 |
| 2021-05-02/a> | Didier Stevens | PuTTY And FileZilla Use The Same Fingerprint Registry Keys |
| 2020-09-30/a> | Johannes Ullrich | Scans for FPURL.xml: Reconnaissance or Not? |
| 2020-09-02/a> | Xavier Mertens | Python and Risky Windows API Calls |
| 2020-09-01/a> | Johannes Ullrich | Exposed Windows Domain Controllers Used in CLDAP DDoS Attacks |
| 2020-08-25/a> | Xavier Mertens | Keep An Eye on LOLBins |
| 2020-06-24/a> | Jan Kopriva | Using Shell Links as zero-touch downloaders and to initiate network connections |
| 2020-03-30/a> | Jan Kopriva | Crashing explorer.exe with(out) a click |
| 2020-03-23/a> | Didier Stevens | Windows Zeroday Actively Exploited: Type 1 Font Parsing Remote Code Execution Vulnerability |
| 2020-03-16/a> | Jan Kopriva | Desktop.ini as a post-exploitation tool |
| 2020-02-18/a> | Jan Kopriva | Discovering contents of folders in Windows without permissions |
| 2020-02-17/a> | Didier Stevens | curl and SSPI |
| 2020-02-15/a> | Didier Stevens | bsdtar on Windows 10 |
| 2020-01-09/a> | Kevin Shortt | Windows 7 - End of Life |
| 2019-06-27/a> | Rob VandenBrink | Finding the Gold in a Pile of Pennies - Long Tail Analysis in PowerShell |
| 2019-06-06/a> | Xavier Mertens | Keep an Eye on Your WMI Logs |
| 2019-05-22/a> | Johannes Ullrich | An Update on the Microsoft Windows RDP "Bluekeep" Vulnerability (CVE-2019-0708) [now with pcaps] |
| 2019-03-05/a> | Rob VandenBrink | Powershell, Active Directory and the Windows Host Firewall |
| 2019-01-14/a> | Rob VandenBrink | Still Running Windows 7? Time to think about that upgrade project! |
| 2018-12-19/a> | Xavier Mertens | Restricting PowerShell Capabilities with NetSh |
| 2018-12-19/a> | Xavier Mertens | Microsoft OOB Patch for Internet Explorer: Scripting Engine Memory Corruption Vulnerability |
| 2018-06-05/a> | Xavier Mertens | Malicious Post-Exploitation Batch File |
| 2018-05-07/a> | Xavier Mertens | Adding Persistence Via Scheduled Tasks |
| 2018-05-02/a> | Russ McRee | Windows Commands Reference - An InfoSec Must Have |
| 2017-11-15/a> | Xavier Mertens | If you want something done right, do it yourself! |
| 2017-11-11/a> | Xavier Mertens | Keep An Eye on your Root Certificates |
| 2017-01-18/a> | Rob VandenBrink | Making Windows 10 a bit less "Creepy" - Common Privacy Settings |
| 2017-01-12/a> | Mark Baggett | System Resource Utilization Monitor |
| 2016-11-18/a> | Didier Stevens | VBA Shellcode and Windows 10 |
| 2016-08-29/a> | Russ McRee | Recommended Reading: Intrusion Detection Using Indicators of Compromise Based on Best Practices and Windows Event Logs |
| 2016-08-02/a> | Tom Webb | Windows 10 Anniversary Update Available |
| 2016-07-12/a> | Xavier Mertens | Hunting for Malicious Files with MISP + OSSEC |
| 2016-05-22/a> | Pasquale Stirparo | The strange case of WinZip MRU Registry key |
| 2016-05-18/a> | Russ McRee | Resources: Windows Auditing & Monitoring, Linux 2FA |
| 2016-04-15/a> | Xavier Mertens | Windows Command Line Persistence? |
| 2016-03-30/a> | Xavier Mertens | What to watch with your FIM? |
| 2016-02-18/a> | Xavier Mertens | Hunting for Executable Code in Windows Environments |
| 2016-01-31/a> | Guy Bruneau | Windows 10 and System Protection for DATA Default is OFF |
| 2015-12-09/a> | Xavier Mertens | Enforcing USB Storage Policy with PowerShell |
| 2015-08-12/a> | Rob VandenBrink | Windows Service Accounts - Why They're Evil and Why Pentesters Love them! |
| 2014-08-15/a> | Tom Webb | AppLocker Event Logs with OSSEC 2.8 |
| 2014-07-05/a> | Guy Bruneau | Java Support ends for Windows XP |
| 2014-04-06/a> | Basil Alawi S.Taher | "Power Worm" PowerShell based Malware |
| 2014-04-04/a> | Rob VandenBrink | Windows 8.1 Released |
| 2014-03-24/a> | Johannes Ullrich | New Microsoft Advisory: Unpatched Word Flaw used in Targeted Attacks |
| 2014-03-04/a> | Daniel Wesemann | XPired! |
| 2014-01-10/a> | Basil Alawi S.Taher | Windows Autorun-3 |
| 2014-01-04/a> | Tom Webb | Monitoring Windows Networks Using Syslog (Part One) |
| 2013-10-30/a> | Russ McRee | SIR v15: Five good reasons to leave Windows XP behind |
| 2013-03-19/a> | Johannes Ullrich | Windows 7 SP1 and Windows Server 2008 R2 SP1 Being "pushed" today |
| 2013-02-28/a> | Daniel Wesemann | Parsing Windows Eventlogs in Powershell |
| 2012-10-24/a> | Rob VandenBrink | Time to run Windows Update - - Microsoft Updates KB2755801 for Windows RT / IE10 / Flash Player - http://technet.microsoft.com/en-us/security/advisory/2755801 |
| 2012-07-19/a> | Mark Baggett | Diagnosing Malware with Resource Monitor |
| 2012-06-25/a> | Guy Bruneau | Issues with Windows Update Agent |
| 2012-05-08/a> | Bojan Zdrnja | Windows Firewall Bypass Vulnerability and NetBIOS NS |
| 2012-05-06/a> | Jim Clausing | Tool updates and Win 8 |
| 2012-04-10/a> | Swa Frantzen | Windows Vista RIP |
| 2011-12-21/a> | Johannes Ullrich | New Vulnerability in Windows 7 64 bit |
| 2011-07-09/a> | Chris Mohan | Safer Windows Incident Response |
| 2011-06-30/a> | Rob VandenBrink | Update for RSA Authentication Manager |
| 2011-06-01/a> | Johannes Ullrich | Enabling Privacy Enhanced Addresses for IPv6 |
| 2011-03-27/a> | Guy Bruneau | Strange Shockwave File with Surprising Attachments |
| 2011-03-15/a> | Lenny Zeltser | Limiting Exploit Capabilities by Using Windows Integrity Levels |
| 2011-02-24/a> | Johannes Ullrich | Windows 7 / 2008 R2 Service Pack 1 Problems |
| 2011-02-23/a> | Johannes Ullrich | Windows 7 Service Pack 1 out |
| 2011-02-16/a> | Jason Lam | Windows 0-day SMB mrxsmb.dll vulnerability |
| 2011-02-10/a> | Chris Mohan | Befriending Windows Security Log Events |
| 2011-01-24/a> | Rob VandenBrink | Where have all the COM Ports Gone? - How enumerating COM ports led to me finding a “misplaced” Microsoft tool |
| 2011-01-04/a> | Johannes Ullrich | Microsoft Advisory: Vulnerability in Graphics Rendering Engine |
| 2010-11-24/a> | Bojan Zdrnja | Privilege escalation 0-day in almost all Windows versions |
| 2010-08-02/a> | Manuel Humberto Santander Pelaez | Securing Windows Internet Kiosk |
| 2010-06-15/a> | Manuel Humberto Santander Pelaez | Microsoft Windows Help and Support Center vulnerability (CVE 2010-1885) exploit in the wild |
| 2010-02-11/a> | Deborah Hale | The Mysterious Blue Screen |
| 2009-11-14/a> | Adrien de Beaupre | Microsoft advisory for Windows 7 / Windows Server 2008 R2 Remote SMB DoS Exploit released |
| 2009-11-12/a> | Rob VandenBrink | Windows 7 / Windows Server 2008 Remote SMB Exploit |
| 2009-10-24/a> | Marcus Sachs | Windows 7 - How is it doing? |
| 2009-09-08/a> | Guy Bruneau | Vista/2008/Windows 7 SMB2 BSOD 0Day |
| 2009-08-26/a> | Johannes Ullrich | WSUS 3.0 SP2 released |
| 2009-07-16/a> | Guy Bruneau | Changes in Windows Security Center |
| 2009-07-02/a> | Daniel Wesemann | Time to update updating on PCs for 3rd party apps |
| 2009-04-16/a> | Adrien de Beaupre | Strange Windows Event Log entry |
| 2009-01-31/a> | Swa Frantzen | Windows 7 - not so secure ? |
| 2008-08-15/a> | Jim Clausing | OMFW 2008 reflections |
| 2008-06-12/a> | Bojan Zdrnja | Safari on Windows - not looking good |
| 2008-05-17/a> | Lorna Hutcheson | XP SP3 Issues |
| 2008-05-06/a> | John Bambenek | Windows XP Service Pack 3 Released |
| 2008-05-01/a> | Adrien de Beaupre | Windows XP SteadyState |
| 2008-04-29/a> | Bojan Zdrnja | Windows Service Pack blocker tool |
| 2008-04-16/a> | William Stearns | Windows XP Service Pack 3 - unofficial schedule: Apr 21-28 |
| 2007-01-03/a> | Toby Kohlenberg | VLC Media Player udp URL handler Format String Vulnerability |
10 |
| 2020-05-14/a> | Rob VandenBrink | Patch Tuesday Revisited - CVE-2020-1048 isn't as "Medium" as MS Would Have You Believe |
| 2020-02-15/a> | Didier Stevens | bsdtar on Windows 10 |
| 2020-01-06/a> | Johannes Ullrich | Increase in Number of Sources January 3rd and 4th: spoofed |
| 2019-03-09/a> | Guy Bruneau | A Comparison Study of SSH Port Activity - TCP 22 & 2222 |
| 2017-07-01/a> | Rick Wanner | Using nmap to scan for MS17-010 (CVE-2017-0143 EternalBlue) |
| 2017-05-23/a> | Rob VandenBrink | What did we Learn from WannaCry? - Oh Wait, We Already Knew That! |
| 2017-05-13/a> | Guy Bruneau | Microsoft Released Guidance for WannaCrypt |
| 2017-01-18/a> | Rob VandenBrink | Making Windows 10 a bit less "Creepy" - Common Privacy Settings |
| 2016-11-18/a> | Didier Stevens | VBA Shellcode and Windows 10 |
| 2016-08-02/a> | Tom Webb | Windows 10 Anniversary Update Available |
| 2016-03-07/a> | Xavier Mertens | Another Malicious Document, Another Way to Deliver Malicious Code |
| 2016-01-31/a> | Guy Bruneau | Windows 10 and System Protection for DATA Default is OFF |
| 2015-02-08/a> | Rob VandenBrink | BURP 1.6.10 Released |
| 2014-05-18/a> | Russ McRee | sed and awk will always rock |
| 2013-12-21/a> | Guy Bruneau | Strange DNS Queries - Request for Packets |
| 2013-11-09/a> | Guy Bruneau | IE Zero-Day Vulnerability Exploiting msvcrt.dll |
| 2013-02-11/a> | John Bambenek | OpenSSL 1.0.1e Released with Corrected fix for CVE-2013-1069, more here: http://www.openssl.org/ |
| 2013-01-05/a> | Guy Bruneau | D-link Wireless-G Router Year Issue (Y2K-plus-13) |
| 2012-09-21/a> | Guy Bruneau | Update for Vulnerabilities in Adobe Flash Player in Internet Explorer 10 (2755801) |
| 2012-07-25/a> | Johannes Ullrich | Apple OS X 10.8 (Mountain Lion) released |
| 2012-07-18/a> | Rob VandenBrink | Vote NO to Weak Keys! |
| 2012-06-25/a> | Guy Bruneau | Issues with Windows Update Agent |
| 2012-05-16/a> | Johannes Ullrich | Got Packets? Odd duplicate DNS replies from 10.x IP Addresses |
| 2012-04-19/a> | Kevin Shortt | OpenSSL Security Advisory - CVE-2012-2110 |
| 2012-02-24/a> | Guy Bruneau | Flashback Trojan in the Wild |
| 2012-02-03/a> | Guy Bruneau | PHP 5.3.10 Released, Fixes CVE-2012-0830 available for download http://www.php.net/archive/2012.php#id2012-02-02-1 |
| 2011-10-03/a> | Tom Liston | Security 101 : Security Basics in 140 Characters Or Less |
| 2011-08-11/a> | Johannes Ullrich | As part of this weeks patch tuesday, microsoft also re-release MS11-043 to address stability issues. |
| 2011-04-28/a> | Chris Mohan | Gathering and use of location information fears - or is it all a bit too late |
| 2011-04-28/a> | Guy Bruneau | VMware ESXi 4.1 Security and Firmware Updates |
| 2011-04-15/a> | Kevin Liston | MS11-020 (KB2508429) Upgrading from Critical to PATCH NOW |
| 2011-02-23/a> | Manuel Humberto Santander Pelaez | Bind DOS vulnerability (CVE-2011-0414) |
| 2011-01-08/a> | Guy Bruneau | PandaLabs 2010 Annual Report |
| 2010-12-20/a> | Guy Bruneau | Highlight of Survey Related to Issues Affecting Businesses in 2010 |
| 2010-11-16/a> | Guy Bruneau | OpenSSL TLS Extension Parsing Race Condition |
| 2010-10-31/a> | Marcus Sachs | Cyber Security Awareness Month - Day 31 - Tying it all together |
| 2010-10-30/a> | Guy Bruneau | Security Update for Shockwave Player |
| 2010-10-30/a> | Guy Bruneau | Cyber Security Awareness Month - Day 30 - Role of the network team |
| 2010-10-29/a> | Manuel Humberto Santander Pelaez | Cyber Security Awareness Month - Day 29- Role of the office geek |
| 2010-10-28/a> | Rick Wanner | Cyber Security Awareness Month - Day 27 - Social Media use in the office |
| 2010-10-28/a> | Tony Carothers | Cyber Security Awareness Month - Day 28 - Role of the employee |
| 2010-10-28/a> | Manuel Humberto Santander Pelaez | CVE-2010-3654 - New dangerous 0-day authplay library adobe products vulnerability |
| 2010-10-26/a> | Pedro Bueno | Cyber Security Awareness Month - Day 26 - Sharing Office Files |
| 2010-10-25/a> | Kevin Shortt | Cyber Security Awareness Month - Day 25 - Using Home Computers for Work |
| 2010-10-24/a> | Swa Frantzen | Cyber Security Awarenes Month - Day 24 - Using work computers at home |
| 2010-10-23/a> | Mark Hofman | Cyber Security Awareness Month - Day 23 - The Importance of compliance |
| 2010-10-22/a> | Daniel Wesemann | Cyber Security Awareness Month - Day 22 - Security of removable media |
| 2010-10-21/a> | Chris Carboni | Cyber Security Awareness Month - Day 21 - Impossible Requests from the Boss |
| 2010-10-20/a> | Jim Clausing | Cyber Security Awareness Month - Day 20 - Securing Mobile Devices |
| 2010-10-19/a> | Rob VandenBrink | Cyber Security Awareness Month - Day 19 - Remote Access Tools |
| 2010-10-19/a> | Rob VandenBrink | Cyber Security Awareness Month - Day 19 - Remote User VPN Tunnels - to Split or not to Split? |
| 2010-10-19/a> | Rob VandenBrink | Cyber Security Awareness Month - Day 19 - VPN Architectures – SSL or IPSec? |
| 2010-10-19/a> | Rob VandenBrink | Cyber Security Awareness Month - Day 19 - Remote User VPN Access – Are things getting too easy, or too hard? |
| 2010-10-19/a> | Rob VandenBrink | Cyber Security Awareness Month - Day 19 - VPN and Remote Access Tools |
| 2010-10-18/a> | Manuel Humberto Santander Pelaez | Cyber Security Awareness Month - Day 18 - What you should tell your boss when there's a crisis |
| 2010-10-17/a> | Stephen Hall | Cyber Security Awareness Month - Day 17 - What a boss should and should not have access to |
| 2010-10-15/a> | Marcus Sachs | Cyber Security Awareness Month - Day 15 - What Teachers Need to Know About Their Students |
| 2010-10-15/a> | Guy Bruneau | Cyber Security Awareness Month - Day 16 - Securing a donated computer |
| 2010-10-14/a> | Johannes Ullrich | Cyber Security Awareness Month - Day 14 - Securing a public computer |
| 2010-10-13/a> | Deborah Hale | Cyber Security Awareness Month - Day 13 - Online Bullying |
| 2010-10-12/a> | Scott Fendley | Cyber Security Awareness Month - Day 12 - Protecting and Managing Your Digital Identity On Social Media Sites |
| 2010-10-11/a> | Rick Wanner | Cyber Security Awareness Month - Day 11 - Safe Browsing for Teens |
| 2010-10-10/a> | Kevin Liston | Cyber Security Awareness Month - Day 10 - Safe browsing for pre-teens |
| 2010-10-09/a> | Kevin Shortt | Cyber Security Awareness Month - Day 9 - Disposal of an Old Computer |
| 2010-10-08/a> | Rick Wanner | Cyber Security Awareness Month - Day 8 - Patch Management and System Updates |
| 2010-10-06/a> | Rob VandenBrink | Cyber Security Awareness Month - Day 7 - Remote Access and Monitoring Tools |
| 2010-10-06/a> | Marcus Sachs | Cyber Security Awareness Month - Day 6 - Computer Monitoring Tools |
| 2010-10-05/a> | Rick Wanner | Cyber Security Awareness Month - Day 5 - Sites you should stay away from |
| 2010-10-04/a> | Daniel Wesemann | Cyber Security Awareness Month - Day 4 - Managing EMail |
| 2010-10-03/a> | Adrien de Beaupre | Cyber Security Awareness Month - Day 3 - Recognizing phishing and online scams |
| 2010-10-02/a> | Mark Hofman | Cyber Security Awareness Month - Day 2 - Securing the Family Network |
| 2010-10-01/a> | Marcus Sachs | Cyber Security Awareness Month - 2010 |
| 2010-10-01/a> | Marcus Sachs | Cyber Security Awareness Month - Day 1 - Securing the Family PC |
| 2010-09-17/a> | Robert Danford | Circa 2007 Linux Kernel Vulnerability Resurfaces (Was CVE-2007-4573, Now CVE-2010-3301) |
| 2010-09-13/a> | Manuel Humberto Santander Pelaez | Adobe SING table parsing exploit (CVE-2010-2883) in the wild |
| 2010-09-12/a> | Manuel Humberto Santander Pelaez | Adobe Acrobat pushstring Memory Corruption paper |
| 2010-09-08/a> | John Bambenek | Adobe Acrobat/Reader 0-day in Wild, Adobe Issues Advisory |
| 2010-08-25/a> | Pedro Bueno | Adobe released security update for Shockwave player that fix several CVEs: APSB1020 |
| 2010-07-20/a> | Manuel Humberto Santander Pelaez | iTunes buffer overflow vulnerability |
| 2010-07-10/a> | Tony Carothers | Oracle July 2010 Pre-Release Announcement |
| 2010-06-15/a> | Manuel Humberto Santander Pelaez | Microsoft Windows Help and Support Center vulnerability (CVE 2010-1885) exploit in the wild |
| 2010-06-02/a> | Mark Hofman | OpenSSL version 1.0.0a released. This fixes a number of security issues. Don't forget a number of commercial appliances will be using this, so look for vendor updates soon. |
| 2010-04-22/a> | Guy Bruneau | MS10-025 Security Update has been Pulled |
| 2010-04-16/a> | G. N. White | MS10-021: Encountering A Failed WinXP Update |
| 2010-03-28/a> | Rick Wanner | Honeynet Project: 2010 Forensic Challenge #3 |
| 2010-03-03/a> | Mark Hofman | MS10-015 re-released |
| 2010-02-19/a> | Mark Hofman | MS10-015 may cause Windows XP to blue screen (but only if you have malware on it) |
| 2010-01-19/a> | Jim Clausing | The IE saga continues, out-of-cycle patch coming soon |
| 2010-01-15/a> | Kevin Liston | Exploit code available for CVE-2010-0249 |
| 2008-10-15/a> | Mari Nichols | Adobe Flash 10 Released |
| 2006-10-10/a> | Johannes Ullrich | MS06-056: ASP.NET XSS Information Disclosure Vulnerability (moderate) |
| 2006-10-10/a> | Johannes Ullrich | MS06-061: XSLT/MSXML Buffer Overflow Code Execution Vulnerability (moderate) |
| 2006-10-10/a> | Kyle Haugsness | MS06-063: Mailslot DoS (Server service) |
| 2000-01-02/a> | Deborah Hale | 2010 A Look Back - 2011 A Look Ahead |
https://www.sans.edu
