Internet Storm Center
Sign In
Sign Up
Participate: Learn more about our honeypot network
https://isc.sans.edu/tools/honeypot/
Handler on Duty:
Xavier Mertens
Threat Level:
green
Date
Author
Title
MEMORY ANALYSIS
2016-10-30
Pasquale Stirparo
Volatility Bot: Automated Memory Analysis
2015-05-03
Russ McRee
VolDiff, for memory image differential analysis
2012-09-19
Kevin Liston
Volatility: 2.2 is Coming Soon
2009-07-26
Jim Clausing
New Volatility plugins
2008-12-13
Jim Clausing
Followup from last shift and some research to do.
2008-11-17
Jim Clausing
Finding stealth injected DLLs
MEMORY
2020-07-27/a>
Johannes Ullrich
In Memory of Donald Smith
2020-06-04/a>
Xavier Mertens
Anti-Debugging Technique based on Memory Protection
2016-10-30/a>
Pasquale Stirparo
Volatility Bot: Automated Memory Analysis
2015-05-03/a>
Russ McRee
VolDiff, for memory image differential analysis
2015-04-24/a>
Basil Alawi S.Taher
Fileless Malware
2015-04-17/a>
Didier Stevens
Memory Forensics Of Network Devices
2014-08-27/a>
Rob VandenBrink
One More Day of Trolling in POS Memory
2014-03-11/a>
Basil Alawi S.Taher
Introduction to Memory Analysis with Mandiant Redline
2014-03-07/a>
Tom Webb
Linux Memory Dump with Rekall
2013-12-12/a>
Basil Alawi S.Taher
Acquiring Memory Images with Dumpit
2013-05-23/a>
Adrien de Beaupre
MoVP II
2013-01-03/a>
Bojan Zdrnja
Memory acquisition traps
2012-09-19/a>
Kevin Liston
Volatility: 2.2 is Coming Soon
2012-05-07/a>
Guy Bruneau
iOS 5.1.1 Software Update for iPod, iPhone, iPad
2010-04-02/a>
Guy Bruneau
Firefox 3.6.3 fix for CVE-2010-1121 http://www.mozilla.org/security/announce/2010/mfsa2010-25.html
2009-07-26/a>
Jim Clausing
New Volatility plugins
2009-02-05/a>
Rick Wanner
Mandiant Memoryze review, Hilighter, other Mandiant tools!
2009-01-02/a>
Rick Wanner
Tools on my Christmas list.
2008-12-13/a>
Jim Clausing
Followup from last shift and some research to do.
2008-11-22/a>
G. N. White
Picture Printing Kiosks & Flash Memory Devices
2008-11-17/a>
Jim Clausing
Finding stealth injected DLLs
ANALYSIS
2023-02-04/a>
Guy Bruneau
Assemblyline as a Malware Analysis Sandbox
2023-01-21/a>
Guy Bruneau
DShield Sensor JSON Log to Elasticsearch
2023-01-08/a>
Guy Bruneau
DShield Sensor JSON Log Analysis
2022-07-29/a>
Johannes Ullrich
PDF Analysis Intro and OpenActions Entries
2022-07-18/a>
Didier Stevens
Adding Your Own Keywords To My PDF Tools
2022-06-01/a>
Jan Kopriva
HTML phishing attachments - now with anti-analysis features
2021-04-10/a>
Guy Bruneau
Building an IDS Sensor with Suricata & Zeek with Logs to ELK
2021-04-06/a>
Jan Kopriva
Malspam with Lokibot vs. Outlook and RFCs
2021-01-30/a>
Guy Bruneau
PacketSifter as Network Parsing and Telemetry Tool
2021-01-14/a>
Bojan Zdrnja
Dynamically analyzing a heavily obfuscated Excel 4 macro malicious file
2020-12-03/a>
Brad Duncan
Traffic Analysis Quiz: Mr Natural
2020-11-11/a>
Brad Duncan
Traffic Analysis Quiz: DESKTOP-FX23IK5
2020-10-01/a>
Daniel Wesemann
Making sense of Azure AD (AAD) activity logs
2020-09-20/a>
Guy Bruneau
Analysis of a Salesforce Phishing Emails
2020-06-01/a>
Jim Clausing
Stackstrings, type 2
2020-05-02/a>
Guy Bruneau
Phishing PDF with Unusual Hostname
2020-01-25/a>
Guy Bruneau
Is Threat Hunting the new Fad?
2020-01-12/a>
Guy Bruneau
ELK Dashboard and Logstash parser for tcp-honeypot Logs
2019-12-29/a>
Guy Bruneau
ELK Dashboard for Pihole Logs
2019-12-07/a>
Guy Bruneau
Integrating Pi-hole Logs in ELK with Logstash
2019-11-23/a>
Guy Bruneau
Local Malware Analysis with Malice
2019-10-18/a>
Xavier Mertens
Quick Malicious VBS Analysis
2019-06-27/a>
Rob VandenBrink
Finding the Gold in a Pile of Pennies - Long Tail Analysis in PowerShell
2019-06-14/a>
Jim Clausing
A few Ghidra tips for IDA users, part 4 - function call graphs
2019-04-17/a>
Jim Clausing
A few Ghidra tips for IDA users, part 2 - strings and parameters
2019-04-08/a>
Jim Clausing
A few Ghidra tips for IDA users, part 1 - the decompiler/unreachable code
2019-04-03/a>
Jim Clausing
A few Ghidra tips for IDA users, part 0 - automatic comments for API call parameters
2019-03-31/a>
Didier Stevens
Maldoc Analysis of the Weekend by a Reader
2019-02-27/a>
Didier Stevens
Maldoc Analysis by a Reader
2018-11-18/a>
Guy Bruneau
Multipurpose PCAP Analysis Tool
2018-10-21/a>
Pasquale Stirparo
Beyond good ol’ LaunchAgent - part 0
2018-08-31/a>
Jim Clausing
Quickie: Using radare2 to disassemble shellcode
2018-06-01/a>
Remco Verhoef
Binary analysis with Radare2
2017-09-29/a>
Lorna Hutcheson
Good Analysis = Understanding(tools + logs + normal)
2017-07-09/a>
Russ McRee
Adversary hunting with SOF-ELK
2017-04-28/a>
Russell Eubanks
KNOW before NO
2017-01-28/a>
Lorna Hutcheson
Packet Analysis - Where do you start?
2016-12-24/a>
Didier Stevens
Pinging All The Way
2016-10-30/a>
Pasquale Stirparo
Volatility Bot: Automated Memory Analysis
2016-10-17/a>
Didier Stevens
Maldoc VBA Anti-Analysis: Video
2016-10-15/a>
Didier Stevens
Maldoc VBA Anti-Analysis
2016-05-14/a>
Guy Bruneau
INetSim as a Basic Honeypot
2016-04-21/a>
Daniel Wesemann
Decoding Pseudo-Darkleech (Part #2)
2015-05-03/a>
Russ McRee
VolDiff, for memory image differential analysis
2014-07-05/a>
Guy Bruneau
Malware Analysis with pedump
2014-04-21/a>
Daniel Wesemann
Finding the bleeders
2014-03-13/a>
Daniel Wesemann
Web server logs containing RS=^ ?
2014-01-14/a>
Chris Mohan
Spamming and scanning botnets - is there something I can do to block them from my site?
2013-10-28/a>
Daniel Wesemann
Exploit cocktail (Struts, Java, Windows) going after 3-month old vulnerabilities
2013-06-18/a>
Russ McRee
Volatility rules...any questions?
2013-05-11/a>
Lenny Zeltser
Extracting Digital Signatures from Signed Malware
2013-03-09/a>
Guy Bruneau
IPv6 Focus Month: IPv6 Encapsulation - Protocol 41
2013-02-03/a>
Lorna Hutcheson
Is it Really an Attack?
2013-01-08/a>
Jim Clausing
Cuckoo 0.5 is out and the world didn't end
2012-12-02/a>
Guy Bruneau
Collecting Logs from Security Devices at Home
2012-09-19/a>
Kevin Liston
Volatility: 2.2 is Coming Soon
2012-09-14/a>
Lenny Zeltser
Analyzing Malicious RTF Files Using OfficeMalScanner's RTFScan
2012-06-21/a>
Russ McRee
Analysis of drive-by attack sample set
2012-06-04/a>
Lenny Zeltser
Decoding Common XOR Obfuscation in Malicious Code
2012-05-23/a>
Mark Baggett
IP Fragmentation Attacks
2012-03-03/a>
Jim Clausing
New automated sandbox for Android malware
2012-02-07/a>
Jim Clausing
Book Review: Practical Packet Analysis, 2nd ed
2011-05-20/a>
Guy Bruneau
Sysinternals Updates, Analyzing Stuxnet Infection with Sysinternals Tools Part 3
2011-04-14/a>
Adrien de Beaupre
Sysinternals updates, a new blog post, and webcast
2011-02-01/a>
Lenny Zeltser
The Importance of HTTP Headers When Investigating Malicious Sites
2010-08-09/a>
Jim Clausing
Free/inexpensive tools for monitoring systems/networks
2010-07-21/a>
Adrien de Beaupre
autorun.inf and .lnk Malware (NOT 'Vulnerability in Windows Shell Could Allow Remote Code Execution' 2286198)
2010-05-26/a>
Bojan Zdrnja
Malware modularization and AV detection evasion
2010-04-11/a>
Marcus Sachs
Network and process forensics toolset
2010-03-26/a>
Daniel Wesemann
Getting the EXE out of the RTF again
2010-02-13/a>
Lorna Hutcheson
Network Traffic Analysis in Reverse
2010-01-14/a>
Bojan Zdrnja
PDF Babushka
2010-01-07/a>
Daniel Wesemann
Static analysis of malicious PDFs
2010-01-07/a>
Daniel Wesemann
Static analysis of malicous PDFs (Part #2)
2009-11-25/a>
Jim Clausing
Updates to my GREM Gold scripts and a new script
2009-11-03/a>
Bojan Zdrnja
Opachki, from (and to) Russia with love
2009-09-25/a>
Lenny Zeltser
Categories of Common Malware Traits
2009-07-26/a>
Jim Clausing
New Volatility plugins
2009-07-02/a>
Daniel Wesemann
Getting the EXE out of the RTF
2009-04-15/a>
Marcus Sachs
2009 Data Breach Investigation Report
2009-03-13/a>
Bojan Zdrnja
When web application security, Microsoft and the AV vendors all fail
2009-02-10/a>
Bojan Zdrnja
More tricks from Conficker and VM detection
2009-02-09/a>
Bojan Zdrnja
Some tricks from Conficker's bag
2009-01-18/a>
Daniel Wesemann
3322. org
2009-01-15/a>
Bojan Zdrnja
Conficker's autorun and social engineering
2009-01-07/a>
Bojan Zdrnja
An Israeli patriot program or a trojan
2009-01-02/a>
Rick Wanner
Tools on my Christmas list.
2008-12-13/a>
Jim Clausing
Followup from last shift and some research to do.
2008-11-17/a>
Marcus Sachs
New Tool: NetWitness Investigator
2008-11-17/a>
Jim Clausing
Finding stealth injected DLLs
2008-09-03/a>
Daniel Wesemann
Static analysis of Shellcode - Part 2
2008-07-07/a>
Pedro Bueno
Bad url classification
2006-10-02/a>
Jim Clausing
Reader's tip of the day: ratios vs. raw counts
2006-09-18/a>
Jim Clausing
Log analysis follow up
2006-09-09/a>
Jim Clausing
Log Analysis tips?
2006-09-09/a>
Jim Clausing
A few preliminary log analysis thoughts
Homepage
Diaries
Podcasts
Jobs
Data
TCP/UDP Port Activity
Port Trends
SSH/Telnet Scanning Activity
Weblogs
Threat Feeds Activity
Threat Feeds Map
Useful InfoSec Links
Presentations & Papers
Research Papers
API
Tools
DShield Sensor
DNS Looking Glass
Honeypot (RPi/AWS)
InfoSec Glossary
Forums
Auditing
Diary Discussions
Forensics
General Discussions
Industry News
Network Security
Penetration Testing
Software Security
Contact Us
Contact Us
About Us
Handlers
Slack Channel
Mastodon
Twitter
Follow the Internet Storm Center on
Twitter