2020-11-07 | Guy Bruneau | Cryptojacking Targeting WebLogic TCP/7001 |
2020-10-29 | Johannes Ullrich | PATCH NOW: CVE-2020-14882 Weblogic Actively Exploited Against Honeypots |
2020-10-01 | Daniel Wesemann | Making sense of Azure AD (AAD) activity logs |
2020-08-14 | Jan Kopriva | Definition of 'overkill' - using 130 MB executable to hide 24 kB malware |
2020-07-27 | Johannes Ullrich | In Memory of Donald Smith |
2020-07-23 | Xavier Mertens | Simple Blocklisting with MISP & pfSense |
2020-02-12 | Rob VandenBrink | March Patch Tuesday is Coming - the LDAP Changes will Change Your Life! |
2020-01-25 | Guy Bruneau | Is Threat Hunting the new Fad? |
2020-01-12 | Guy Bruneau | ELK Dashboard and Logstash parser for tcp-honeypot Logs |
2019-12-07 | Guy Bruneau | Integrating Pi-hole Logs in ELK with Logstash |
2019-10-30 | Xavier Mertens | Keep an Eye on Remote Access to Mailboxes |
2019-09-17 | Rob VandenBrink | Investigating Gaps in your Windows Event Logs |
2019-06-19 | Johannes Ullrich | Critical Actively Exploited WebLogic Flaw Patched CVE-2019-2729 |
2019-06-06 | Xavier Mertens | Keep an Eye on Your WMI Logs |
2019-05-19 | Guy Bruneau | Is Metadata Only Approach, Good Enough for Network Traffic Analysis? |
2019-04-28 | Johannes Ullrich | Update about Weblogic CVE-2019-2725 (Exploits Used in the Wild, Patch Status) |
2019-04-25 | Rob VandenBrink | Unpatched Vulnerability Alert - WebLogic Zero Day |
2019-02-21 | Xavier Mertens | Simple Powershell Keyloggers are Back |
2019-02-18 | Didier Stevens | Know What You Are Logging |
2019-02-07 | Xavier Mertens | Phishing Kit with JavaScript Keylogger |
2018-07-20 | Kevin Liston | Weblogic Exploit Code Made Public (CVE-2018-2893) |
2018-07-17 | Xavier Mertens | Searching for Geographically Improbable Login Attempts |
2018-06-21 | Xavier Mertens | Are Your Hunting Rules Still Working? |
2018-06-19 | Xavier Mertens | PowerShell: ScriptBlock Logging... Or Not? |
2018-06-06 | Xavier Mertens | Converting PCAP Web Traffic to Apache Log |
2018-05-03 | Renato Marinho | WebLogic Exploited in the Wild (Again) |
2018-01-08 | Johannes Ullrich | A Story About PeopleSoft: How to Make $250k Without Leaving Home. |
2018-01-07 | Guy Bruneau | SSH Scans by Clients Types |
2017-09-29 | Lorna Hutcheson | Good Analysis = Understanding(tools + logs + normal) |
2017-07-09 | Russ McRee | Adversary hunting with SOF-ELK |
2017-04-20 | Xavier Mertens | DNS Query Length... Because Size Does Matter |
2016-12-27 | Guy Bruneau | Using daemonlogger as a Software Tap |
2016-08-29 | Russ McRee | Recommended Reading: Intrusion Detection Using Indicators of Compromise Based on Best Practices and Windows Event Logs |
2016-06-01 | Xavier Mertens | Docker Containers Logging |
2015-07-31 | Russ McRee | Tech tip: Invoke a system command in R |
2015-07-31 | Russ McRee | Tech tip follow-up: Using the data Invoked with R's system command |
2015-06-01 | Tom Webb | Submit Dshield ASA Logs |
2015-05-20 | Brad Duncan | Logjam - vulnerabilities in Diffie-Hellman key exchange affect browsers and servers using TLS |
2015-04-23 | Bojan Zdrnja | When automation does not help |
2015-03-11 | Rob VandenBrink | Syslog Skeet Shooting - Targetting Real Problems in Event Logs |
2014-09-27 | Guy Bruneau | What has Bash and Heartbleed Taught Us? |
2014-09-22 | Johannes Ullrich | Fake LogMeIn Certificate Update with Bad AV Detection Rate |
2014-08-15 | Tom Webb | AppLocker Event Logs with OSSEC 2.8 |
2014-08-05 | Johannes Ullrich | Synolocker: Why OFFLINE Backups are important |
2014-04-21 | Daniel Wesemann | Finding the bleeders |
2014-04-04 | Rob VandenBrink | Dealing with Disaster - A Short Malware Incident Response |
2014-04-01 | Johannes Ullrich | cmd.so Synology Scanner Also Found on Routers |
2014-03-31 | Johannes Ullrich | More Device Malware: This is why your DVR attacked my Synology Disk Station (and now with Bitcoin Miner!) |
2014-03-28 | Johannes Ullrich | War of the Bots: When DVRs attack NASs |
2014-03-26 | Johannes Ullrich | Let's Finally "Nail" This Port 5000 Traffic - Synology owners needed. |
2014-03-13 | Daniel Wesemann | Web server logs containing RS=^ ? |
2014-02-14 | Chris Mohan | Scanning activity for /siemens/bootstrapping/JnlpBrowser/Development/ |
2014-02-09 | Basil Alawi S.Taher | Mandiant Highlighter 2 |
2014-01-27 | Basil Alawi S.Taher | Log Parsing with Mandiant Highlighter (1) |
2014-01-14 | Chris Mohan | Spamming and scanning botnets - is there something I can do to block them from my site? |
2014-01-04 | Tom Webb | Monitoring Windows Networks Using Syslog (Part One) |
2013-12-03 | Rob VandenBrink | Even in the Quietest Moments ... |
2013-11-16 | Guy Bruneau | Sagan as a Log Normalizer |
2013-10-10 | Mark Hofman | CSAM Some more unusual scans |
2013-09-24 | Tom Webb | IDS, NSM, and Log Management with Security Onion 12.04.3 |
2013-09-11 | Alex Stanford | Getting Started with Rsyslog Filters |
2013-09-02 | Guy Bruneau | Snort IDS Sensor with Sguil New ISO Released |
2013-08-21 | Alex Stanford | Psst. Your Browser Knows All Your Secrets. |
2013-02-28 | Daniel Wesemann | Parsing Windows Eventlogs in Powershell |
2013-02-27 | Adam Swanger | Guest Diary: Dylan Johnson - There's value in them there logs! |
2013-02-22 | Chris Mohan | PHP 5.4.12 and PHP 5.3.22 released http://www.php.net/ChangeLog-5.php |
2013-02-17 | Guy Bruneau | HP ArcSight Connector Appliance and Logger Vulnerabilities |
2013-02-06 | Johannes Ullrich | Are you losing system logging information (and don't know it)? |
2012-12-02 | Guy Bruneau | Collecting Logs from Security Devices at Home |
2012-07-13 | Russ McRee | 2 for 1: SANSFIRE & MSRA presentations |
2012-07-11 | Rick Wanner | Excellent Security Education Resources |
2012-05-02 | Bojan Zdrnja | Monitoring VMWare logs |
2012-04-08 | Chris Mohan | Blog Log: More noise or a rich source of intelligence? |
2011-11-19 | Kevin Liston | Monitoring your Log Monitoring Process |
2011-06-21 | Chris Mohan | Australian government security audit report shows tough love to agencies |
2011-06-20 | Chris Mohan | Log files - are you reviewing yours? |
2011-05-17 | Johannes Ullrich | A Couple Days of Logs: Looking for the Russian Business Network |
2011-03-29 | Daniel Wesemann | Making sense of RSA ACE server audit logs |
2011-03-11 | Guy Bruneau | Snort IDS Sensor with Sguil Framework ISO |
2011-01-24 | Rob VandenBrink | Where have all the COM Ports Gone? - How enumerating COM ports led to me finding a “misplaced” Microsoft tool |
2010-12-24 | Daniel Wesemann | A question of class |
2010-09-28 | Daniel Wesemann | Supporting the economy (in Russia and Ukraine) |
2010-07-24 | Manuel Humberto Santander Pelaez | Transmiting logon information unsecured in the network |
2010-04-06 | Daniel Wesemann | Application Logs |
2010-03-10 | Rob VandenBrink | What's My Firewall Telling Me? (Part 4) |
2010-03-05 | Kyle Haugsness | What is your firewall log telling you - responses |
2010-02-23 | Mark Hofman | What is your firewall telling you and what is TCP249? |
2010-02-06 | Guy Bruneau | Oracle WebLogic Server Security Alert |
2010-01-29 | Johannes Ullrich | Analyzing isc.sans.org weblogs, part 2, RFI attacks |
2010-01-20 | Johannes Ullrich | Weathering the Storm Part 1: An analysis of our SANS ISC weblogs http://appsecstreetfighter.com |
2009-10-26 | Johannes Ullrich | Web honeypot Update |
2009-10-26 | Johannes Ullrich | Today: ISC Login bugfix day. If you have issues logging in using OpenID, please email a copy of your OpenID URL to jullrich\at\sans.edu |
2009-04-16 | Adrien de Beaupre | Strange Windows Event Log entry |
2009-04-09 | Johannes Ullrich | Conficker update with payload |
2009-03-26 | Mark Hofman | Webhoneypot fun |
2009-01-09 | Johannes Ullrich | SANS Log Management Survey |
2008-11-05 | donald smith | If you missed President Elect Obamas speech have some malware instead |
2008-08-19 | Johannes Ullrich | A morning stroll through my web logs |
2008-08-05 | Daniel Wesemann | Watching those DNS logs |
2006-10-02 | Jim Clausing | Reader's tip of the day: ratios vs. raw counts |
2006-09-18 | Jim Clausing | Log analysis follow up |
2006-09-09 | Jim Clausing | A few preliminary log analysis thoughts |
2006-09-09 | Jim Clausing | Log Analysis tips? |