Internet Storm Center
Sign In
Sign Up
Participate: Learn more about our honeypot network
https://isc.sans.edu/tools/honeypot/
Handler on Duty:
Tom Webb
Threat Level:
green
Date
Author
Title
WINDOWS 7
2019-01-14
Rob VandenBrink
Still Running Windows 7? Time to think about that upgrade project!
2013-03-19
Johannes Ullrich
Windows 7 SP1 and Windows Server 2008 R2 SP1 Being "pushed" today
2012-07-19
Mark Baggett
Diagnosing Malware with Resource Monitor
2011-12-21
Johannes Ullrich
New Vulnerability in Windows 7 64 bit
2011-06-01
Johannes Ullrich
Enabling Privacy Enhanced Addresses for IPv6
2011-02-23
Johannes Ullrich
Windows 7 Service Pack 1 out
2009-11-14
Adrien de Beaupre
Microsoft advisory for Windows 7 / Windows Server 2008 R2 Remote SMB DoS Exploit released
2009-11-12
Rob VandenBrink
Windows 7 / Windows Server 2008 Remote SMB Exploit
2009-10-24
Marcus Sachs
Windows 7 - How is it doing?
2009-07-16
Guy Bruneau
Changes in Windows Security Center
WINDOWS
2022-11-05/a>
Guy Bruneau
Windows Malware with VHD Extension
2022-06-26/a>
Didier Stevens
My Paste Command
2022-06-24/a>
Xavier Mertens
Python (ab)using The Windows GUI
2022-04-28/a>
Johannes Ullrich
A Day of SMB: What does our SMB/RPC Honeypot see? CVE-2022-26809
2022-04-14/a>
Johannes Ullrich
An Update on CVE-2022-26809 - MSRPC Vulnerabliity - PATCH NOW
2022-04-06/a>
Brad Duncan
Windows MetaStealer Malware
2022-02-25/a>
Didier Stevens
Windows, Fixed IPv4 Addresses and APIPA
2021-10-14/a>
Xavier Mertens
Port-Forwarding with Windows for the Win
2021-07-21/a>
Johannes Ullrich
"Summer of SAM": Microsoft Releases Guidance for CVE-2021-36934
2021-07-19/a>
Rick Wanner
New Windows Print Spooler Vulnerability - CVE-2021-34481
2021-05-02/a>
Didier Stevens
PuTTY And FileZilla Use The Same Fingerprint Registry Keys
2020-09-30/a>
Johannes Ullrich
Scans for FPURL.xml: Reconnaissance or Not?
2020-09-02/a>
Xavier Mertens
Python and Risky Windows API Calls
2020-09-01/a>
Johannes Ullrich
Exposed Windows Domain Controllers Used in CLDAP DDoS Attacks
2020-08-25/a>
Xavier Mertens
Keep An Eye on LOLBins
2020-06-24/a>
Jan Kopriva
Using Shell Links as zero-touch downloaders and to initiate network connections
2020-03-30/a>
Jan Kopriva
Crashing explorer.exe with(out) a click
2020-03-23/a>
Didier Stevens
Windows Zeroday Actively Exploited: Type 1 Font Parsing Remote Code Execution Vulnerability
2020-03-16/a>
Jan Kopriva
Desktop.ini as a post-exploitation tool
2020-02-18/a>
Jan Kopriva
Discovering contents of folders in Windows without permissions
2020-02-17/a>
Didier Stevens
curl and SSPI
2020-02-15/a>
Didier Stevens
bsdtar on Windows 10
2020-01-09/a>
Kevin Shortt
Windows 7 - End of Life
2019-06-27/a>
Rob VandenBrink
Finding the Gold in a Pile of Pennies - Long Tail Analysis in PowerShell
2019-06-06/a>
Xavier Mertens
Keep an Eye on Your WMI Logs
2019-05-22/a>
Johannes Ullrich
An Update on the Microsoft Windows RDP "Bluekeep" Vulnerability (CVE-2019-0708) [now with pcaps]
2019-03-05/a>
Rob VandenBrink
Powershell, Active Directory and the Windows Host Firewall
2019-01-14/a>
Rob VandenBrink
Still Running Windows 7? Time to think about that upgrade project!
2018-12-19/a>
Xavier Mertens
Restricting PowerShell Capabilities with NetSh
2018-12-19/a>
Xavier Mertens
Microsoft OOB Patch for Internet Explorer: Scripting Engine Memory Corruption Vulnerability
2018-06-05/a>
Xavier Mertens
Malicious Post-Exploitation Batch File
2018-05-07/a>
Xavier Mertens
Adding Persistence Via Scheduled Tasks
2018-05-02/a>
Russ McRee
Windows Commands Reference - An InfoSec Must Have
2017-11-15/a>
Xavier Mertens
If you want something done right, do it yourself!
2017-11-11/a>
Xavier Mertens
Keep An Eye on your Root Certificates
2017-01-18/a>
Rob VandenBrink
Making Windows 10 a bit less "Creepy" - Common Privacy Settings
2017-01-12/a>
Mark Baggett
System Resource Utilization Monitor
2016-11-18/a>
Didier Stevens
VBA Shellcode and Windows 10
2016-08-29/a>
Russ McRee
Recommended Reading: Intrusion Detection Using Indicators of Compromise Based on Best Practices and Windows Event Logs
2016-08-02/a>
Tom Webb
Windows 10 Anniversary Update Available
2016-07-12/a>
Xavier Mertens
Hunting for Malicious Files with MISP + OSSEC
2016-05-22/a>
Pasquale Stirparo
The strange case of WinZip MRU Registry key
2016-05-18/a>
Russ McRee
Resources: Windows Auditing & Monitoring, Linux 2FA
2016-04-15/a>
Xavier Mertens
Windows Command Line Persistence?
2016-03-30/a>
Xavier Mertens
What to watch with your FIM?
2016-02-18/a>
Xavier Mertens
Hunting for Executable Code in Windows Environments
2016-01-31/a>
Guy Bruneau
Windows 10 and System Protection for DATA Default is OFF
2015-12-09/a>
Xavier Mertens
Enforcing USB Storage Policy with PowerShell
2015-08-12/a>
Rob VandenBrink
Windows Service Accounts - Why They're Evil and Why Pentesters Love them!
2014-08-15/a>
Tom Webb
AppLocker Event Logs with OSSEC 2.8
2014-07-05/a>
Guy Bruneau
Java Support ends for Windows XP
2014-04-06/a>
Basil Alawi S.Taher
"Power Worm" PowerShell based Malware
2014-04-04/a>
Rob VandenBrink
Windows 8.1 Released
2014-03-24/a>
Johannes Ullrich
New Microsoft Advisory: Unpatched Word Flaw used in Targeted Attacks
2014-03-04/a>
Daniel Wesemann
XPired!
2014-01-10/a>
Basil Alawi S.Taher
Windows Autorun-3
2014-01-04/a>
Tom Webb
Monitoring Windows Networks Using Syslog (Part One)
2013-10-30/a>
Russ McRee
SIR v15: Five good reasons to leave Windows XP behind
2013-03-19/a>
Johannes Ullrich
Windows 7 SP1 and Windows Server 2008 R2 SP1 Being "pushed" today
2013-02-28/a>
Daniel Wesemann
Parsing Windows Eventlogs in Powershell
2012-10-24/a>
Rob VandenBrink
Time to run Windows Update - - Microsoft Updates KB2755801 for Windows RT / IE10 / Flash Player - http://technet.microsoft.com/en-us/security/advisory/2755801
2012-07-19/a>
Mark Baggett
Diagnosing Malware with Resource Monitor
2012-06-25/a>
Guy Bruneau
Issues with Windows Update Agent
2012-05-08/a>
Bojan Zdrnja
Windows Firewall Bypass Vulnerability and NetBIOS NS
2012-05-06/a>
Jim Clausing
Tool updates and Win 8
2012-04-10/a>
Swa Frantzen
Windows Vista RIP
2011-12-21/a>
Johannes Ullrich
New Vulnerability in Windows 7 64 bit
2011-07-09/a>
Chris Mohan
Safer Windows Incident Response
2011-06-30/a>
Rob VandenBrink
Update for RSA Authentication Manager
2011-06-01/a>
Johannes Ullrich
Enabling Privacy Enhanced Addresses for IPv6
2011-03-27/a>
Guy Bruneau
Strange Shockwave File with Surprising Attachments
2011-03-15/a>
Lenny Zeltser
Limiting Exploit Capabilities by Using Windows Integrity Levels
2011-02-24/a>
Johannes Ullrich
Windows 7 / 2008 R2 Service Pack 1 Problems
2011-02-23/a>
Johannes Ullrich
Windows 7 Service Pack 1 out
2011-02-16/a>
Jason Lam
Windows 0-day SMB mrxsmb.dll vulnerability
2011-02-10/a>
Chris Mohan
Befriending Windows Security Log Events
2011-01-24/a>
Rob VandenBrink
Where have all the COM Ports Gone? - How enumerating COM ports led to me finding a “misplaced” Microsoft tool
2011-01-04/a>
Johannes Ullrich
Microsoft Advisory: Vulnerability in Graphics Rendering Engine
2010-11-24/a>
Bojan Zdrnja
Privilege escalation 0-day in almost all Windows versions
2010-08-02/a>
Manuel Humberto Santander Pelaez
Securing Windows Internet Kiosk
2010-06-15/a>
Manuel Humberto Santander Pelaez
Microsoft Windows Help and Support Center vulnerability (CVE 2010-1885) exploit in the wild
2010-02-11/a>
Deborah Hale
The Mysterious Blue Screen
2009-11-14/a>
Adrien de Beaupre
Microsoft advisory for Windows 7 / Windows Server 2008 R2 Remote SMB DoS Exploit released
2009-11-12/a>
Rob VandenBrink
Windows 7 / Windows Server 2008 Remote SMB Exploit
2009-10-24/a>
Marcus Sachs
Windows 7 - How is it doing?
2009-09-08/a>
Guy Bruneau
Vista/2008/Windows 7 SMB2 BSOD 0Day
2009-08-26/a>
Johannes Ullrich
WSUS 3.0 SP2 released
2009-07-16/a>
Guy Bruneau
Changes in Windows Security Center
2009-07-02/a>
Daniel Wesemann
Time to update updating on PCs for 3rd party apps
2009-04-16/a>
Adrien de Beaupre
Strange Windows Event Log entry
2009-01-31/a>
Swa Frantzen
Windows 7 - not so secure ?
2008-08-15/a>
Jim Clausing
OMFW 2008 reflections
2008-06-12/a>
Bojan Zdrnja
Safari on Windows - not looking good
2008-05-17/a>
Lorna Hutcheson
XP SP3 Issues
2008-05-06/a>
John Bambenek
Windows XP Service Pack 3 Released
2008-05-01/a>
Adrien de Beaupre
Windows XP SteadyState
2008-04-29/a>
Bojan Zdrnja
Windows Service Pack blocker tool
2008-04-16/a>
William Stearns
Windows XP Service Pack 3 - unofficial schedule: Apr 21-28
2007-01-03/a>
Toby Kohlenberg
VLC Media Player udp URL handler Format String Vulnerability
7
2022-12-16/a>
Guy Bruneau
VMware Security Updates
2022-09-06/a>
Didier Stevens
Analysis of an Encoded Cobalt Strike Beacon
2022-09-04/a>
Didier Stevens
Video: VBA Maldoc & UTF7 (APT-C-35)
2022-08-29/a>
Didier Stevens
Update: VBA Maldoc & UTF7 (APT-C-35)
2022-08-28/a>
Didier Stevens
Dealing With False Positives when Scanning Memory Dumps for Cobalt Strike Beacons
2022-08-26/a>
Guy Bruneau
HTTP/2 Packet Analysis with Wireshark
2022-08-16/a>
Didier Stevens
VBA Maldoc & UTF7 (APT-C-35)
2022-08-14/a>
Johannes Ullrich
Realtek SDK SIP ALG Vulnerability: A Big Deal, but not much you can do about it. CVE 2022-27255
2022-07-09/a>
Didier Stevens
7-Zip Editing & MoW
2022-07-04/a>
Didier Stevens
7-Zip & MoW: "For Office files"
2022-07-03/a>
Didier Stevens
7-Zip & MoW
2022-06-09/a>
Brad Duncan
TA570 Qakbot (Qbot) tries CVE-2022-30190 (Follina) exploit (ms-msdt)
2022-05-11/a>
Brad Duncan
TA578 using thread-hijacked emails to push ISO files for Bumblebee malware
2022-01-12/a>
Johannes Ullrich
A Quick CVE-2022-21907 FAQ
2021-12-18/a>
Guy Bruneau
VMware Security Update - https://www.vmware.com/security/advisories/VMSA-2021-0030.html
2021-10-16/a>
Guy Bruneau
Apache is Actively Scan for CVE-2021-41773 & CVE-2021-42013
2021-10-06/a>
Johannes Ullrich
Apache 2.4.49 Directory Traversal Vulnerability (CVE-2021-41773)
2021-06-30/a>
Johannes Ullrich
CVE-2021-1675: Incomplete Patch and Leaked RCE Exploit
2021-06-26/a>
Guy Bruneau
CVE-2019-9670: Zimbra Collaboration Suite XXE vulnerability
2021-06-03/a>
Jim Clausing
Strange goings on with port 37
2021-04-08/a>
Xavier Mertens
Simple Powershell Ransomware Creating a 7Z Archive of your Files
2021-02-24/a>
Brad Duncan
Malspam pushes GuLoader for Remcos RAT
2020-12-18/a>
Jan Kopriva
A slightly optimistic tale of how patching went for CVE-2019-19781
2020-10-28/a>
Jan Kopriva
SMBGhost - the critical vulnerability many seem to have forgotten to patch
2020-08-08/a>
Guy Bruneau
Scanning Activity Include Netcat Listener
2020-05-01/a>
Jim Clausing
Attack traffic on TCP port 9673
2020-01-13/a>
Didier Stevens
Citrix ADC Exploits: Overview of Observed Payloads
2020-01-11/a>
Johannes Ullrich
Citrix ADC Exploits are Public and Heavily Used. Attempts to Install Backdoor
2020-01-09/a>
Kevin Shortt
Windows 7 - End of Life
2020-01-07/a>
Johannes Ullrich
A Quick Update on Scanning for CVE-2019-19781 (Citrix ADC / Gateway Vulnerability)
2019-11-06/a>
Brad Duncan
More malspam pushing Formbook
2019-08-01/a>
Johannes Ullrich
What is Listening On Port 9527/TCP?
2019-07-26/a>
Kevin Shortt
DVRIP Port 34567 - Uptick
2019-06-19/a>
Johannes Ullrich
Critical Actively Exploited WebLogic Flaw Patched CVE-2019-2729
2019-05-22/a>
Johannes Ullrich
An Update on the Microsoft Windows RDP "Bluekeep" Vulnerability (CVE-2019-0708) [now with pcaps]
2019-04-28/a>
Johannes Ullrich
Update about Weblogic CVE-2019-2725 (Exploits Used in the Wild, Patch Status)
2019-02-02/a>
Guy Bruneau
Scanning for WebDAV PROPFIND Exploiting CVE-2017-7269
2019-01-14/a>
Rob VandenBrink
Still Running Windows 7? Time to think about that upgrade project!
2018-08-20/a>
Didier Stevens
OpenSSH user enumeration (CVE-2018-15473)
2017-08-26/a>
Didier Stevens
Malware analysis: searching for dots
2017-07-01/a>
Rick Wanner
Using nmap to scan for MS17-010 (CVE-2017-0143 EternalBlue)
2017-05-13/a>
Guy Bruneau
Microsoft Released Guidance for WannaCrypt
2017-01-10/a>
Johannes Ullrich
Port 37777 "MapTable" Requests
2016-10-22/a>
Guy Bruneau
Request for Packets TCP 4786 - CVE-2016-6385
2016-06-15/a>
Richard Porter
Warp Speed Ahead, L7 Open Source Packet Generator: Warp17
2016-02-13/a>
Guy Bruneau
VMware VMSA-2015-0007.3 has been Re-released
2016-01-31/a>
Guy Bruneau
OpenSSL 1.0.2 Advisory and Update
2015-11-21/a>
Guy Bruneau
Nmap 7.00 is out!
2015-08-12/a>
Rob VandenBrink
Wireshark 1.12.7 is released, multiple fixes. Find the release notes at: https://www.wireshark.org/docs/relnotes/wireshark-1.12.7.html and the binaries at: https://www.wireshark.org/download.html
2014-09-25/a>
Johannes Ullrich
Update on CVE-2014-6271: Vulnerability in bash (shellshock)
2014-09-24/a>
Pedro Bueno
Attention *NIX admins, time to patch!
2014-07-07/a>
Johannes Ullrich
Multi Platform *Coin Miner Attacking Routers on Port 32764
2014-03-24/a>
Johannes Ullrich
New Microsoft Advisory: Unpatched Word Flaw used in Targeted Attacks
2014-02-27/a>
Richard Porter
DDoS and BCP 38
2014-02-07/a>
Rob VandenBrink
New ISO Standards on Vulnerability Handling and Disclosure
2013-12-05/a>
Mark Hofman
Updated Standards Part 1 - ISO 27001
2013-11-14/a>
Johannes Ullrich
iOS 7.0.4 released. Fixes issue with unauthorized in App purchases http://lists.apple.com/archives/security-announce/2013/Nov/msg00000.html
2013-11-09/a>
Guy Bruneau
IE Zero-Day Vulnerability Exploiting msvcrt.dll
2013-09-17/a>
John Bambenek
Microsoft Releases Out-of-Band Advisory for all Versions of Internet Explorer
2013-05-09/a>
Johannes Ullrich
Microsoft released a Fix-it for the Internet Explorer 8 Vulnerability http://support.microsoft.com/kb/2847140
2013-04-16/a>
Rob VandenBrink
Java 7 Update 21 is available - Watch for Behaviour Changes !
2013-03-25/a>
Johannes Ullrich
IPv6 Focus Month: IPv6 over IPv4 Preference
2013-03-19/a>
Johannes Ullrich
Windows 7 SP1 and Windows Server 2008 R2 SP1 Being "pushed" today
2013-01-09/a>
Richard Porter
The 80's called - They Want Their Mainframe Back!
2013-01-04/a>
Guy Bruneau
"FixIt" Patch for CVE-2012-4792 Bypassed
2012-10-17/a>
Rob VandenBrink
Cyber Security Awareness Month - Day 17 - A Standard for Risk Management - ISO 27005
2012-10-08/a>
Mark Hofman
Cyber Security Awareness Month - Day 8 ISO 27001
2012-09-21/a>
Guy Bruneau
IE Cumulative Updates MS12-063 - KB2744842
2012-09-21/a>
Guy Bruneau
Update for Vulnerabilities in Adobe Flash Player in Internet Explorer 10 (2755801)
2012-09-17/a>
Rob VandenBrink
IE Zero Day is "For Real"
2012-07-19/a>
Mark Baggett
Diagnosing Malware with Resource Monitor
2012-06-18/a>
Guy Bruneau
CVE-2012-1875 exploit is now available
2012-05-25/a>
Guy Bruneau
Technical Analysis of Flash Player CVE-2012-0779
2012-05-05/a>
Tony Carothers
Vulnerability Exploit for Snow Leopard
2012-04-27/a>
Mark Hofman
Microsoft has added MSSQL 2008 R2 SP1 to the list of affected software for MS12-027 (Thanks Ryan). More info here --> http://technet.microsoft.com/security/bulletin/ms12-027
2011-12-21/a>
Johannes Ullrich
New Vulnerability in Windows 7 64 bit
2011-11-03/a>
Richard Porter
An Apple, Inc. Sandbox to play in.
2011-06-01/a>
Johannes Ullrich
Enabling Privacy Enhanced Addresses for IPv6
2011-02-23/a>
Johannes Ullrich
Windows 7 Service Pack 1 out
2010-12-20/a>
Guy Bruneau
Patch Issues with Outlook 2007
2010-09-17/a>
Robert Danford
Circa 2007 Linux Kernel Vulnerability Resurfaces (Was CVE-2007-4573, Now CVE-2010-3301)
2010-08-22/a>
Manuel Humberto Santander Pelaez
SCADA: A big challenge for information security professionals
2010-07-20/a>
Manuel Humberto Santander Pelaez
iTunes buffer overflow vulnerability
2010-07-20/a>
Manuel Humberto Santander Pelaez
Truecrypt 7.0 released
2010-03-10/a>
Rob VandenBrink
Microsoft Security Advisory 981374 - Remote Code Execution Vulnerability for IE6 and IE7
2010-03-10/a>
Rob VandenBrink
Microsoft re-release of KB973811 - attacks on Extended Protection for Authentication
2010-02-21/a>
Tony Carothers
TCP Port 12174 Request For Packets
2009-12-29/a>
Rick Wanner
What's up with port 12174? Possible Symantec server compromise?
2009-11-22/a>
Marcus Sachs
IE6 and IE7 0-Day Reported
2009-11-14/a>
Adrien de Beaupre
Microsoft advisory for Windows 7 / Windows Server 2008 R2 Remote SMB DoS Exploit released
2009-11-12/a>
Rob VandenBrink
Windows 7 / Windows Server 2008 Remote SMB Exploit
2009-11-07/a>
Marcus Sachs
More Thoughts on Legacy Systems
2009-10-24/a>
Marcus Sachs
Windows 7 - How is it doing?
2009-10-06/a>
Adrien de Beaupre
Cyber Security Awareness Month - Day 6 ports 67&68 udp - bootp and dhcp
2009-10-05/a>
Adrien de Beaupre
Cyber Security Awareness Month - Day 5 port 31337
2009-07-16/a>
Guy Bruneau
Changes in Windows Security Center
2009-05-28/a>
Stephen Hall
Microsoft DirectShow vulnerability
2009-05-27/a>
donald smith
WebDAV write-up
2009-05-02/a>
Rick Wanner
Significant increase in port 2967 traffic
2009-02-13/a>
Andre Ludwig
Third party information on conficker
2009-01-31/a>
Swa Frantzen
Windows 7 - not so secure ?
2009-01-12/a>
William Salusky
Downadup / Conficker - MS08-067 exploit and Windows domain account lockout
2008-08-10/a>
Stephen Hall
Fake IE 7 update spam doing the rounds
2008-08-02/a>
Maarten Van Horenbeeck
Issues affecting sites using Sitemeter [resolved]
2008-07-02/a>
Jim Clausing
The scoop on the spike in UDP port 7 traffic
2006-11-20/a>
Joel Esler
MS06-070 Remote Exploit
Homepage
Diaries
Podcasts
Jobs
Data
TCP/UDP Port Activity
Port Trends
SSH/Telnet Scanning Activity
Weblogs
Threat Feeds Activity
Threat Feeds Map
Useful InfoSec Links
Presentations & Papers
Research Papers
API
Tools
DShield Sensor
DNS Looking Glass
Honeypot (RPi/AWS)
InfoSec Glossary
Forums
Auditing
Diary Discussions
Forensics
General Discussions
Industry News
Network Security
Penetration Testing
Software Security
Contact Us
Contact Us
About Us
Handlers
Slack Channel
Mastodon
Twitter
Subscribe to the Internet Storm Center
YouTube Channel