Threat Level: green Handler on Duty: Didier Stevens

SANS ISC: Diaries by Keyword Diaries by Keyword

Participate: Learn more about our honeypot network
https://isc.sans.edu/honeypot.html

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
Date Author Title
2020-10-01Daniel WesemannMaking sense of Azure AD (AAD) activity logs
2020-08-14Jan KoprivaDefinition of 'overkill' - using 130 MB executable to hide 24 kB malware
2020-07-27Johannes UllrichIn Memory of Donald Smith
2020-07-23Xavier MertensSimple Blocklisting with MISP & pfSense
2020-02-12Rob VandenBrinkMarch Patch Tuesday is Coming - the LDAP Changes will Change Your Life!
2020-01-25Guy BruneauIs Threat Hunting the new Fad?
2020-01-12Guy BruneauELK Dashboard and Logstash parser for tcp-honeypot Logs
2019-12-07Guy BruneauIntegrating Pi-hole Logs in ELK with Logstash
2019-10-30Xavier MertensKeep an Eye on Remote Access to Mailboxes
2019-09-17Rob VandenBrinkInvestigating Gaps in your Windows Event Logs
2019-06-19Johannes UllrichCritical Actively Exploited WebLogic Flaw Patched CVE-2019-2729
2019-06-06Xavier MertensKeep an Eye on Your WMI Logs
2019-05-19Guy BruneauIs Metadata Only Approach, Good Enough for Network Traffic Analysis?
2019-04-28Johannes UllrichUpdate about Weblogic CVE-2019-2725 (Exploits Used in the Wild, Patch Status)
2019-04-25Rob VandenBrinkUnpatched Vulnerability Alert - WebLogic Zero Day
2019-02-21Xavier MertensSimple Powershell Keyloggers are Back
2019-02-18Didier StevensKnow What You Are Logging
2019-02-07Xavier Mertens Phishing Kit with JavaScript Keylogger
2018-07-20Kevin ListonWeblogic Exploit Code Made Public (CVE-2018-2893)
2018-07-17Xavier MertensSearching for Geographically Improbable Login Attempts
2018-06-21Xavier MertensAre Your Hunting Rules Still Working?
2018-06-19Xavier MertensPowerShell: ScriptBlock Logging... Or Not?
2018-06-06Xavier MertensConverting PCAP Web Traffic to Apache Log
2018-05-03Renato MarinhoWebLogic Exploited in the Wild (Again)
2018-01-08Johannes UllrichA Story About PeopleSoft: How to Make $250k Without Leaving Home.
2018-01-07Guy BruneauSSH Scans by Clients Types
2017-09-29Lorna HutchesonGood Analysis = Understanding(tools + logs + normal)
2017-07-09Russ McReeAdversary hunting with SOF-ELK
2017-04-20Xavier MertensDNS Query Length... Because Size Does Matter
2016-12-27Guy BruneauUsing daemonlogger as a Software Tap
2016-08-29Russ McReeRecommended Reading: Intrusion Detection Using Indicators of Compromise Based on Best Practices and Windows Event Logs
2016-06-01Xavier MertensDocker Containers Logging
2015-07-31Russ McReeTech tip: Invoke a system command in R
2015-07-31Russ McReeTech tip follow-up: Using the data Invoked with R's system command
2015-06-01Tom WebbSubmit Dshield ASA Logs
2015-05-20Brad DuncanLogjam - vulnerabilities in Diffie-Hellman key exchange affect browsers and servers using TLS
2015-04-23Bojan ZdrnjaWhen automation does not help
2015-03-11Rob VandenBrinkSyslog Skeet Shooting - Targetting Real Problems in Event Logs
2014-09-27Guy BruneauWhat has Bash and Heartbleed Taught Us?
2014-09-22Johannes UllrichFake LogMeIn Certificate Update with Bad AV Detection Rate
2014-08-15Tom WebbAppLocker Event Logs with OSSEC 2.8
2014-08-05Johannes UllrichSynolocker: Why OFFLINE Backups are important
2014-04-21Daniel WesemannFinding the bleeders
2014-04-04Rob VandenBrinkDealing with Disaster - A Short Malware Incident Response
2014-04-01Johannes Ullrichcmd.so Synology Scanner Also Found on Routers
2014-03-31Johannes UllrichMore Device Malware: This is why your DVR attacked my Synology Disk Station (and now with Bitcoin Miner!)
2014-03-28Johannes UllrichWar of the Bots: When DVRs attack NASs
2014-03-26Johannes UllrichLet's Finally "Nail" This Port 5000 Traffic - Synology owners needed.
2014-03-13Daniel WesemannWeb server logs containing RS=^ ?
2014-02-14Chris MohanScanning activity for /siemens/bootstrapping/JnlpBrowser/Development/
2014-02-09Basil Alawi S.TaherMandiant Highlighter 2
2014-01-27Basil Alawi S.TaherLog Parsing with Mandiant Highlighter (1)
2014-01-14Chris MohanSpamming and scanning botnets - is there something I can do to block them from my site?
2014-01-04Tom WebbMonitoring Windows Networks Using Syslog (Part One)
2013-12-03Rob VandenBrinkEven in the Quietest Moments ...
2013-11-16Guy BruneauSagan as a Log Normalizer
2013-10-10Mark HofmanCSAM Some more unusual scans
2013-09-24Tom WebbIDS, NSM, and Log Management with Security Onion 12.04.3
2013-09-11Alex StanfordGetting Started with Rsyslog Filters
2013-09-02Guy BruneauSnort IDS Sensor with Sguil New ISO Released
2013-08-21Alex StanfordPsst. Your Browser Knows All Your Secrets.
2013-02-28Daniel WesemannParsing Windows Eventlogs in Powershell
2013-02-27Adam SwangerGuest Diary: Dylan Johnson - There's value in them there logs!
2013-02-22Chris MohanPHP 5.4.12 and PHP 5.3.22 released http://www.php.net/ChangeLog-5.php
2013-02-17Guy BruneauHP ArcSight Connector Appliance and Logger Vulnerabilities
2013-02-06Johannes UllrichAre you losing system logging information (and don't know it)?
2012-12-02Guy BruneauCollecting Logs from Security Devices at Home
2012-07-13Russ McRee2 for 1: SANSFIRE & MSRA presentations
2012-07-11Rick WannerExcellent Security Education Resources
2012-05-02Bojan ZdrnjaMonitoring VMWare logs
2012-04-08Chris MohanBlog Log: More noise or a rich source of intelligence?
2011-11-19Kevin ListonMonitoring your Log Monitoring Process
2011-06-21Chris MohanAustralian government security audit report shows tough love to agencies
2011-06-20Chris MohanLog files - are you reviewing yours?
2011-05-17Johannes UllrichA Couple Days of Logs: Looking for the Russian Business Network
2011-03-29Daniel WesemannMaking sense of RSA ACE server audit logs
2011-03-11Guy BruneauSnort IDS Sensor with Sguil Framework ISO
2011-01-24Rob VandenBrinkWhere have all the COM Ports Gone? - How enumerating COM ports led to me finding a “misplaced” Microsoft tool
2010-12-24Daniel WesemannA question of class
2010-09-28Daniel WesemannSupporting the economy (in Russia and Ukraine)
2010-07-24Manuel Humberto Santander PelaezTransmiting logon information unsecured in the network
2010-04-06Daniel WesemannApplication Logs
2010-03-10Rob VandenBrinkWhat's My Firewall Telling Me? (Part 4)
2010-03-05Kyle HaugsnessWhat is your firewall log telling you - responses
2010-02-23Mark HofmanWhat is your firewall telling you and what is TCP249?
2010-02-06Guy BruneauOracle WebLogic Server Security Alert
2010-01-29Johannes UllrichAnalyzing isc.sans.org weblogs, part 2, RFI attacks
2010-01-20Johannes UllrichWeathering the Storm Part 1: An analysis of our SANS ISC weblogs http://appsecstreetfighter.com
2009-10-26Johannes UllrichToday: ISC Login bugfix day. If you have issues logging in using OpenID, please email a copy of your OpenID URL to jullrich\at\sans.edu
2009-10-26Johannes UllrichWeb honeypot Update
2009-04-16Adrien de BeaupreStrange Windows Event Log entry
2009-04-09Johannes UllrichConficker update with payload
2009-03-26Mark HofmanWebhoneypot fun
2009-01-09Johannes UllrichSANS Log Management Survey
2008-11-05donald smithIf you missed President Elect Obamas speech have some malware instead
2008-08-19Johannes UllrichA morning stroll through my web logs
2008-08-05Daniel WesemannWatching those DNS logs
2006-10-02Jim ClausingReader's tip of the day: ratios vs. raw counts
2006-09-18Jim ClausingLog analysis follow up
2006-09-09Jim ClausingLog Analysis tips?
2006-09-09Jim ClausingA few preliminary log analysis thoughts