Date Author Title

UN PEACKEEEPING

2021-08-04Yee Ching TokPivoting and Hunting for Shenanigans from a Reported Phishing Domain

UN

2024-10-03/a>Guy BruneauKickstart Your DShield Honeypot [Guest Diary]
2024-09-25/a>Guy BruneauOSINT - Image Analysis or More Where, When, and Metadata [Guest Diary]
2024-09-11/a>Guy BruneauHygiene, Hygiene, Hygiene! [Guest Diary]
2024-09-04/a>Guy Bruneau Attack Surface [Guest Diary]
2024-08-27/a>Guy BruneauVega-Lite with Kibana to Parse and Display IP Activity over Time
2024-08-23/a>Jesse La GrewPandas Errors: What encoding are my logs in?
2024-08-20/a>Guy BruneauMapping Threats with DNSTwist and the Internet Storm Center [Guest Diary]
2024-08-07/a>Guy BruneauSame Scripts, Different Day: What My DShield Honeypot Taught Me About the Importance of Security Fundamentals [Guest Diary]
2024-07-16/a>Guy BruneauWho You Gonna Call? AndroxGh0st Busters! [Guest Diary]
2024-07-08/a>Xavier MertensKunai: Keep an Eye on your Linux Hosts Activity
2024-06-26/a>Guy BruneauWhat Setting Live Traps for Cybercriminals Taught Me About Security [Guest Diary]
2024-06-20/a>Guy BruneauNo Excuses, Free Tools to Help Secure Authentication in Ubuntu Linux [Guest Diary]
2024-06-13/a>Guy BruneauThe Art of JQ and Command-line Fu [Guest Diary]
2024-05-28/a>Guy BruneauIs that It? Finding the Unknown: Correlations Between Honeypot Logs & PCAPs [Guest Diary]
2024-05-22/a>Guy BruneauAnalysis of ?redtail? File Uploads to ICS Honeypot, a Multi-Architecture Coin Miner [Guest Diary]
2024-04-16/a>Yee Ching TokRolling Back Packages on Ubuntu/Debian
2024-04-07/a>Guy BruneauA Use Case for Adding Threat Hunting to Your Security Operations Team. Detecting Adversaries Abusing Legitimate Tools in A Customer Environment. [Guest Diary]
2024-02-27/a>Johannes UllrichTake Downs and the Rest of Us: Do they matter?
2024-02-25/a>Guy BruneauUtilizing the VirusTotal API to Query Files Uploaded to DShield Honeypot [Guest Diary]
2023-12-10/a>Guy BruneauHoneypots: From the Skeptical Beginner to the Tactical Enthusiast
2023-08-17/a>Jesse La GrewCommand Line Parsing - Are These Really Unique Strings?
2023-06-09/a>Xavier MertensUndetected PowerShell Backdoor Disguised as a Profile File
2023-02-21/a>Xavier MertensPhishing Page Branded with Your Corporate Website
2022-12-20/a>Xavier MertensLinux File System Monitoring & Actions
2022-12-19/a>Xavier MertensHunting for Mastodon Servers
2022-11-04/a>Xavier MertensRemcos Downloader with Unicode Obfuscation
2022-08-31/a>Johannes UllrichUnderscores and DNS: The Privacy Story
2022-08-23/a>Xavier MertensWho's Looking at Your security.txt File?
2022-07-23/a>Guy BruneauAnalysis of SSH Honeypot Data with PowerBI
2022-06-17/a>Bojan ZdrnjaCritical vulnerability in Splunk Enterprise?s deployment server functionality
2022-06-02/a>Johannes UllrichQuick Answers in Incident Response: RECmd.exe
2022-04-05/a>Johannes UllrichWebLogic Crypto Miner Malware Disabling Alibaba Cloud Monitoring Tools
2022-03-12/a>Didier StevensICMP Messages: Original Datagram Field
2022-02-18/a>Xavier MertensRemcos RAT Delivered Through Double Compressed Archive
2022-02-01/a>Xavier MertensAutomation is Nice But Don't Replace Your Knowledge
2021-12-15/a>Xavier MertensSimple but Undetected PowerShell Backdoor
2021-11-30/a>Johannes UllrichHunting for PHPUnit Installed via Composer
2021-11-04/a>Tom WebbXmount for Disk Images
2021-08-04/a>Yee Ching TokPivoting and Hunting for Shenanigans from a Reported Phishing Domain
2021-05-18/a>Xavier MertensFrom RunDLL32 to JavaScript then PowerShell
2021-03-17/a>Xavier MertensDefenders, Know Your Operating System Like Attackers Do!
2021-03-05/a>Xavier MertensSpam Farm Spotted in the Wild
2021-01-21/a>Xavier MertensPowershell Dropping a REvil Ransomware
2021-01-19/a>Russ McReeGordon for fast cyber reputation checks
2020-08-24/a>Xavier MertensTracking A Malware Campaign Through VT
2020-07-23/a>Xavier MertensSimple Blocklisting with MISP & pfSense
2020-06-25/a>Johannes UllrichTech Tuesday Recap / Recordings: Part 2 (Installing the Honeypot) release.
2020-03-13/a>Rob VandenBrinkNot all Ethernet NICs are Created Equal - Trying to Capture Invalid Ethernet Frames
2020-01-25/a>Guy BruneauIs Threat Hunting the new Fad?
2020-01-21/a>Russ McReeDeepBlueCLI: Powershell Threat Hunting
2019-10-10/a>Rob VandenBrinkMining Live Networks for OUI Data Oddness
2019-07-17/a>Xavier MertensAnalyzis of DNS TXT Records
2019-05-06/a>Didier StevensText and Text
2019-05-01/a>Xavier MertensAnother Day, Another Suspicious UDF File
2019-04-26/a>Rob VandenBrinkPillaging Passwords from Service Accounts
2019-04-25/a>Rob VandenBrinkService Accounts Redux - Collecting Service Accounts with PowerShell
2019-03-27/a>Xavier MertensRunning your Own Passive DNS Service
2019-02-19/a>Didier StevensIdentifying Files: Failure Happens
2019-01-27/a>Russell EubanksResolve to Be More Involved In Your Local Community - REVISITED
2018-11-20/a>Xavier MertensQuerying DShield from Cortex
2018-11-07/a>Bojan ZdrnjaTunneling scanners (or really anything) over SSH
2018-10-17/a>Russ McReeRedHunt Linux - Adversary Emulation, Threat Hunting & Intelligence
2018-09-20/a>Xavier MertensHunting for Suspicious Processes with OSSEC
2018-08-10/a>Remco VerhoefHunting SSL/TLS clients using JA3
2018-06-21/a>Xavier MertensAre Your Hunting Rules Still Working?
2018-04-27/a>Tom WebbMore Threat Hunting with User Agent and Drupal Exploits
2018-03-05/a>Xavier MertensMalicious Bash Script with Multiple Features
2017-12-02/a>Xavier MertensUsing Bad Material for the Good
2017-11-23/a>Xavier MertensProactive Malicious Domain Search
2017-10-18/a>Renato MarinhoBaselining Servers to Detect Outliers
2017-09-02/a>Xavier MertensAutoIT based malware back in the wild
2017-07-09/a>Russ McReeAdversary hunting with SOF-ELK
2017-05-08/a>Renato MarinhoExploring a P2P Transient Botnet - From Discovery to Enumeration
2017-04-16/a>Johannes UllrichTool to Detect Active Phishing Attacks Using Unicode Look-Alike Domains
2017-03-15/a>Xavier MertensRetro Hunting!
2017-01-28/a>Guy BruneauRequest for Packets and Logs - TCP 5358
2016-11-24/a>Didier StevensExtracting Shellcode From JavaScript
2016-07-12/a>Xavier MertensHunting for Malicious Files with MISP + OSSEC
2016-05-26/a>Xavier MertensKeeping an Eye on Tor Traffic
2016-03-30/a>Xavier MertensWhat to watch with your FIM?
2016-02-26/a>Xavier MertensQuick Audit of *NIX Systems
2015-12-22/a>Rick WannerThe other Juniper vulnerability - CVE-2015-7756
2015-12-10/a>Rob VandenBrinkUninstalling Problem Applications using Powershell
2015-11-09/a>John BambenekICYMI: Widespread Unserialize Vulnerability in Java
2015-08-16/a>Guy BruneauAre you a "Hunter"?
2015-08-12/a>Rob VandenBrinkWindows Service Accounts - Why They're Evil and Why Pentesters Love them!
2015-07-17/a>Didier StevensAutoruns and VirusTotal
2015-05-23/a>Guy BruneauBusiness Value in "Big Data"
2015-04-29/a>Daniel WesemannUDP/3478 to Amazon 54.84.9.242 -- got packets? (solved)
2015-02-10/a>Mark BaggettDetecting Mimikatz Use On Your Network
2015-01-23/a>Adrien de BeaupreInfocon change to yellow for Adobe Flash issues
2014-11-24/a>Richard PorterSomeone is using this? PoS: Compressor
2014-10-14/a>Johannes UllrichUpdates for Firefox and Thunderbird. http://www.mozilla.org/firefox/new/
2014-04-29/a>Russ McReeFirefox 29.0 & Thunderbird 24.5 released: http://www.mozilla.org/security/known-vulnerabilities/
2014-04-28/a>Russ McReeUbuntu 14.04 lockscreen bypass
2014-04-21/a>Daniel WesemannAllow us to leave!
2014-03-22/a>Guy BruneauHow the Compromise of a User Account Lead to a Spam Incident
2014-02-18/a>Johannes UllrichMore Details About "TheMoon" Linksys Worm
2014-01-22/a>Chris MohaniTunes 11.1.4 is now available - addressing numerous CVEs
2014-01-10/a>Basil Alawi S.TaherWindows Autorun-3
2014-01-01/a>Russ McReeSix degrees of celebration: Juniper, ANT, Shodan, Maltego, Cisco, and Tails
2013-11-02/a>Rick WannerProtecting Your Family's Computers
2013-11-01/a>Russ McReeSecunia's PSI Country Report - Q3 2013
2013-09-18/a>Rob VandenBrinkiTunes 11.1 released, fixes CVE-2013-1035 remote code execution vulnerability. (Look for specifics at http://support.apple.com/kb/HT1222 sometime soon)
2013-09-07/a>Guy BruneauMicrosoft September Patch Pre-Announcement
2013-07-21/a>Guy BruneauUbuntu Forums Security Breach
2013-07-12/a>Johannes UllrichMicrosoft Teredo Server "Sunset"
2013-06-21/a>Guy BruneauSysinternals Updates for Autoruns, Strings & ZoomIt http://blogs.technet.com/b/sysinternals/archive/2013/06/20/updates-autoruns-v11-61-strings-v2-52-zoomit-v4-5.aspx
2013-06-20/a>Guy BruneauHP iLO3/iLO4 Remote Unauthorized Access with Single-Sign-On
2013-05-20/a>Johannes UllrichUbuntu Package available to submit firewall logs to DShield
2013-05-14/a>Swa FrantzenFirefox & Thunderbird released
2013-04-03/a>Mark HofmanFirefox 20 and Thunderbird 17.0.5 updates
2013-03-28/a>John BambenekWhere Were You During the Great DDoS Cybergeddon of 2013?
2013-02-25/a>Johannes UllrichPunkspider enumerates web application vulnerabilities
2013-02-20/a>Johannes UllrichUpdate Palooza
2013-01-30/a>Richard PorterGetting Involved with the Local Community
2013-01-10/a>Rob VandenBrinkWhat Else runs Telnets? Or, Pentesters Love Video Conferencing Units Too!
2013-01-09/a>Rob VandenBrinkFirefox and Thunderbird Updates
2012-12-10/a>Johannes UllrichYour CPA License has not been revoked
2012-10-30/a>Richard PorterSplunk 5.0 SP-CAAAHB4 http://www.splunk.com/view/SP-CAAAHB4
2012-10-11/a>Rob VandenBrinkFirefox 16 / Thunderbird 16 updates
2012-07-25/a>Johannes UllrichApple OS X 10.8 (Mountain Lion) released
2012-06-29/a>Bojan ZdrnjaDShield for Splunk
2012-06-12/a>Scott FendleyApple iTunes Security Update
2012-06-06/a>Jim ClausingFirefox, Thunderbird, and Seamonkey Security Updates
2012-03-07/a>Guy BruneauReflected XSS in Splunk Web Affecting Version 4.0 to 4.3
2012-01-13/a>Guy BruneauSysinternals Updates - http://blogs.technet.com/b/sysinternals/archive/2012/01/13/updates-autoruns-v11-21-coreinfo-v3-03-portmon-v-3-03-process-explorer-v15-12-mark-s-blog-and-mark-at-rsa-2012.aspx
2011-12-29/a>Richard PorterASP.Net Vulnerability
2011-11-08/a>Swa FrantzenFirefox 8.0 released
2011-11-07/a>Rob VandenBrinkJuniper BGP issues causing locallized Internet Problems
2011-10-17/a>Rob VandenBrinkCritical Control 11: Account Monitoring and Control
2011-10-11/a>Swa FrantzenApple iTunes 10.5
2011-10-01/a>Mark HofmanHot on the heels fo FF, Thunderbird v 7.0.1 and SeaMonkey v 2.4.1 have been updated.
2011-09-27/a>donald smithNew feature in JUNOS to drop or ignore path attributes.
2011-08-31/a>Johannes UllrichFirefox/Thunderbird 6.0.1 released to blocklist bad DigiNotar SSL certificates
2011-08-15/a>Mark HofmanHow to find unwanted files on workstations
2011-06-28/a>Johannes UllrichUpdate: Thunderbird 5.0 released. https://www.mozilla.org/en-US/thunderbird/
2011-06-21/a>Guy BruneauFirefox 5.0 is out with support Do Not Track on Multiple Platform - http://www.mozilla.com/en-US/firefox/new/
2011-04-29/a>Guy BruneauFirefox, Thunderbird and SeaMonkey Security Updates
2011-03-12/a>Chris MohanApple releases iTunes 10.2.1 - http://support.apple.com/kb/DL1103
2011-03-05/a>Mark HofmanNot surprisingly Thunderbird was also updated. Details here --> http://www.mozillamessaging.com/en-US/thunderbird/3.1.9/releasenotes/
2011-03-02/a>Chris MohaniTunes 10.2 now out
2011-02-25/a>Johannes UllrichThunderbolt Security Speculations
2011-02-21/a>Adrien de BeaupreKaspersky update servers unreachable
2011-01-15/a>Jim ClausingWhat's up with port 8881?
2010-11-25/a>Bojan ZdrnjaSecunia's DNS/domain hijacked?
2010-11-17/a>Guy BruneauCisco Unified Videoconferencing Affected by Multiple Vulnerabilities
2010-11-12/a>Guy BruneauScripting with Unix Date
2010-11-01/a>Manuel Humberto Santander PelaezCheckpoint UTM-1 edge VPN boxes worldwide did an unscheduled reboot
2010-10-20/a>Jim ClausingThunderbird 3.1.4 and 3.0.9 released, includes security patches ( http://www.mozillamessaging.com/thunderbird/3.1.5/releasenotes/ )
2010-10-19/a>Rob VandenBrinkCyber Security Awareness Month - Day 19 - Remote User VPN Tunnels - to Split or not to Split?
2010-08-03/a>Johannes UllrichSolar activity may cause problems this week
2010-07-24/a>Manuel Humberto Santander PelaezTransmiting logon information unsecured in the network
2010-07-20/a>Manuel Humberto Santander PelaeziTunes buffer overflow vulnerability
2010-07-14/a>Deborah HaleSecunia Half Year Report for 2010 shows interesting trends
2010-07-08/a>Kyle HaugsnessUbuntu privilege escalation via PAM
2010-07-06/a>Rob VandenBrinkBogus Support Organizations use Live Operators to Install Malware
2010-07-05/a>Manuel Humberto Santander PelaezApple ITunes account security compromised
2010-06-18/a>Adrien de BeaupreThunderbird 3.05 released
2010-06-13/a>Rick WannerUnRealCD compromised by Trojan
2010-05-19/a>Jason LamEFF paper about browser tracking
2010-04-09/a>Mark HofmanAdobe launch issue response/work around.
2010-04-02/a>Guy BruneauApple QuickTime and iTunes Security Update
2010-03-27/a>Guy BruneauCreate a Summary of IP Addresses from PCAP Files using Unix Tools
2010-01-27/a>Raul SilesEuropean Union Security Challenge (Campus Party 2010)
2009-12-19/a>Deborah HaleEducationing Our Communities
2009-10-02/a>Stephen HallNew SysInternal fun for the weekend
2009-09-08/a>Guy BruneauBug Fixes in Sun SDK 5 and Java SE 6
2009-08-21/a>Rick WannerTime to update...New Thunderbird version!
2009-07-09/a>John BambenekLatest Updates on Ongoing DDoS on Governmental/Commercial Websites in USA and S. Korea
2009-06-23/a>Bojan ZdrnjaNew Thunderbird out, patches couple of vulnerabilities
2009-06-16/a>John BambenekIran Internet Blackout: Using Twitter for Operational Intelligence
2009-06-10/a>Swa FrantzenJava 6 update 14 released
2009-05-11/a>Mari NicholsSysinternals Updates 3 Applications
2009-04-10/a>Stephen HallHosted javascript leading to .cn PDF malware
2009-03-20/a>Stephen HallMaking the most of your runbooks
2009-03-13/a>Mark HofmanUbuntu users, today is a good day to patch
2009-02-25/a>donald smithAutoRun disabling patch released
2009-01-15/a>Bojan ZdrnjaConficker's autorun and social engineering
2009-01-12/a>William SaluskyDownadup / Conficker - MS08-067 exploit and Windows domain account lockout
2008-12-31/a>David GoldsmithThunderbird 2.0.0.19 Released
2008-12-25/a>Maarten Van HorenbeeckMerry Christmas, and beware of digital hitchhikers!
2008-12-01/a>Jason LamCall for volunteers - Web Honeypot Project
2008-11-29/a>Pedro BuenoUbuntu users: Time to update!
2008-11-05/a>donald smithBot net hunters get an improved tool from SRI bothunters
2008-10-01/a>Rick WannerHandler Mailbag
2008-09-26/a>Patrick NolanFirefox v2.0.0.17 and Thunderbird v2.0.0.17 release fixes vulnerabilities
2008-09-09/a>Swa FrantzenApple updates iTunes+QuickTime
2008-07-24/a>Bojan ZdrnjaMozilla releases Thunderbrid 2.0.0.16, fixes security vulnerabilities
2008-07-11/a>Jim ClausingHandling the load
2008-07-07/a>Jason LamWe need academic volunteers - Web security research
2008-05-23/a>Mike PoorCisco IOS Rootkit thoughts
2008-05-09/a>Joel EslerThunderbird 2.0.0.14 is out!
2008-04-08/a>Swa FrantzenSymantec's Global Internet Security Threat Report

PEACKEEEPING

2021-08-04/a>Yee Ching TokPivoting and Hunting for Shenanigans from a Reported Phishing Domain