Date Author Title

LOGS ANALYSIS

2023-01-21Guy BruneauDShield Sensor JSON Log to Elasticsearch
2023-01-08Guy BruneauDShield Sensor JSON Log Analysis

LOGS

2024-03-29/a>Xavier MertensQuick Forensics Analysis of Apache logs
2023-12-10/a>Guy BruneauHoneypots: From the Skeptical Beginner to the Tactical Enthusiast
2023-11-20/a>Jesse La GrewOverflowing Web Honeypot Logs
2023-08-31/a>Guy BruneauPotential Weaponizing of Honeypot Logs [Guest Diary]
2023-07-23/a>Guy BruneauInstall & Configure Filebeat on Raspberry Pi ARM64 to Parse DShield Sensor Logs
2023-05-14/a>Guy BruneauDShield Sensor Update
2023-01-21/a>Guy BruneauDShield Sensor JSON Log to Elasticsearch
2023-01-08/a>Guy BruneauDShield Sensor JSON Log Analysis
2022-12-21/a>Guy BruneauDShield Sensor Setup in Azure
2021-10-11/a>Johannes UllrichThings that go "Bump" in the Night: Non HTTP Requests Hitting Web Servers
2021-09-11/a>Guy BruneauShipping to Elasticsearch Microsoft DNS Logs
2021-03-12/a>Guy BruneauMicrosoft DHCP Logs Shipped to ELK
2021-02-13/a>Guy BruneauUsing Logstash to Parse IPtables Firewall Logs
2020-07-23/a>Xavier MertensSimple Blocklisting with MISP & pfSense
2020-01-12/a>Guy BruneauELK Dashboard and Logstash parser for tcp-honeypot Logs
2019-12-07/a>Guy BruneauIntegrating Pi-hole Logs in ELK with Logstash
2019-09-17/a>Rob VandenBrinkInvestigating Gaps in your Windows Event Logs
2019-06-06/a>Xavier MertensKeep an Eye on Your WMI Logs
2019-05-19/a>Guy BruneauIs Metadata Only Approach, Good Enough for Network Traffic Analysis?
2018-07-17/a>Xavier MertensSearching for Geographically Improbable Login Attempts
2018-06-21/a>Xavier MertensAre Your Hunting Rules Still Working?
2017-07-09/a>Russ McReeAdversary hunting with SOF-ELK
2016-08-29/a>Russ McReeRecommended Reading: Intrusion Detection Using Indicators of Compromise Based on Best Practices and Windows Event Logs
2016-06-01/a>Xavier MertensDocker Containers Logging
2014-08-15/a>Tom WebbAppLocker Event Logs with OSSEC 2.8
2014-02-14/a>Chris MohanScanning activity for /siemens/bootstrapping/JnlpBrowser/Development/
2014-02-09/a>Basil Alawi S.TaherMandiant Highlighter 2
2014-01-04/a>Tom WebbMonitoring Windows Networks Using Syslog (Part One)
2013-12-03/a>Rob VandenBrinkEven in the Quietest Moments ...
2013-10-10/a>Mark HofmanCSAM Some more unusual scans
2012-12-02/a>Guy BruneauCollecting Logs from Security Devices at Home
2012-07-13/a>Russ McRee2 for 1: SANSFIRE & MSRA presentations
2012-07-11/a>Rick WannerExcellent Security Education Resources
2012-05-02/a>Bojan ZdrnjaMonitoring VMWare logs
2012-04-08/a>Chris MohanBlog Log: More noise or a rich source of intelligence?
2011-11-19/a>Kevin ListonMonitoring your Log Monitoring Process
2011-06-21/a>Chris MohanAustralian government security audit report shows tough love to agencies
2011-06-20/a>Chris MohanLog files - are you reviewing yours?
2011-05-17/a>Johannes UllrichA Couple Days of Logs: Looking for the Russian Business Network
2010-12-24/a>Daniel WesemannA question of class
2010-04-06/a>Daniel WesemannApplication Logs
2010-03-10/a>Rob VandenBrinkWhat's My Firewall Telling Me? (Part 4)
2010-02-23/a>Mark HofmanWhat is your firewall telling you and what is TCP249?
2010-01-29/a>Johannes UllrichAnalyzing isc.sans.org weblogs, part 2, RFI attacks
2010-01-20/a>Johannes UllrichWeathering the Storm Part 1: An analysis of our SANS ISC weblogs http://appsecstreetfighter.com
2009-10-26/a>Johannes UllrichWeb honeypot Update
2009-01-09/a>Johannes UllrichSANS Log Management Survey
2008-08-19/a>Johannes UllrichA morning stroll through my web logs
2008-08-05/a>Daniel WesemannWatching those DNS logs
2006-09-18/a>Jim ClausingLog analysis follow up
2006-09-09/a>Jim ClausingLog Analysis tips?
2006-09-09/a>Jim ClausingA few preliminary log analysis thoughts

ANALYSIS

2024-10-17/a>Guy BruneauScanning Activity from Subnet 15.184.0.0/16
2024-09-25/a>Guy BruneauOSINT - Image Analysis or More Where, When, and Metadata [Guest Diary]
2024-09-18/a>Guy BruneauTime-to-Live Analysis of DShield Data with Vega-Lite
2024-09-11/a>Guy BruneauHygiene, Hygiene, Hygiene! [Guest Diary]
2024-08-27/a>Guy BruneauVega-Lite with Kibana to Parse and Display IP Activity over Time
2024-08-16/a>Jesse La Grew[Guest Diary] 7 minutes and 4 steps to a quick win: A write-up on custom tools
2024-06-13/a>Guy BruneauThe Art of JQ and Command-line Fu [Guest Diary]
2024-05-28/a>Guy BruneauIs that It? Finding the Unknown: Correlations Between Honeypot Logs & PCAPs [Guest Diary]
2024-04-29/a>Guy BruneauLinux Trojan - Xorddos with Filename eyshcjdmzg
2024-03-29/a>Xavier MertensQuick Forensics Analysis of Apache logs
2024-02-25/a>Guy BruneauUtilizing the VirusTotal API to Query Files Uploaded to DShield Honeypot [Guest Diary]
2024-02-03/a>Guy BruneauDShield Sensor Log Collection with Elasticsearch
2023-11-17/a>Jan KoprivaPhishing page with trivial anti-analysis features
2023-02-04/a>Guy BruneauAssemblyline as a Malware Analysis Sandbox
2023-01-21/a>Guy BruneauDShield Sensor JSON Log to Elasticsearch
2023-01-08/a>Guy BruneauDShield Sensor JSON Log Analysis
2022-07-29/a>Johannes UllrichPDF Analysis Intro and OpenActions Entries
2022-07-18/a>Didier StevensAdding Your Own Keywords To My PDF Tools
2022-06-01/a>Jan KoprivaHTML phishing attachments - now with anti-analysis features
2021-04-10/a>Guy BruneauBuilding an IDS Sensor with Suricata & Zeek with Logs to ELK
2021-04-06/a>Jan KoprivaMalspam with Lokibot vs. Outlook and RFCs
2021-01-30/a>Guy BruneauPacketSifter as Network Parsing and Telemetry Tool
2021-01-14/a>Bojan ZdrnjaDynamically analyzing a heavily obfuscated Excel 4 macro malicious file
2020-12-03/a>Brad DuncanTraffic Analysis Quiz: Mr Natural
2020-11-11/a>Brad DuncanTraffic Analysis Quiz: DESKTOP-FX23IK5
2020-10-01/a>Daniel WesemannMaking sense of Azure AD (AAD) activity logs
2020-09-20/a>Guy BruneauAnalysis of a Salesforce Phishing Emails
2020-06-01/a>Jim ClausingStackstrings, type 2
2020-05-02/a>Guy BruneauPhishing PDF with Unusual Hostname
2020-01-25/a>Guy BruneauIs Threat Hunting the new Fad?
2020-01-12/a>Guy BruneauELK Dashboard and Logstash parser for tcp-honeypot Logs
2019-12-29/a>Guy BruneauELK Dashboard for Pihole Logs
2019-12-07/a>Guy BruneauIntegrating Pi-hole Logs in ELK with Logstash
2019-11-23/a>Guy BruneauLocal Malware Analysis with Malice
2019-10-18/a>Xavier MertensQuick Malicious VBS Analysis
2019-06-27/a>Rob VandenBrinkFinding the Gold in a Pile of Pennies - Long Tail Analysis in PowerShell
2019-06-14/a>Jim ClausingA few Ghidra tips for IDA users, part 4 - function call graphs
2019-04-17/a>Jim ClausingA few Ghidra tips for IDA users, part 2 - strings and parameters
2019-04-08/a>Jim ClausingA few Ghidra tips for IDA users, part 1 - the decompiler/unreachable code
2019-04-03/a>Jim ClausingA few Ghidra tips for IDA users, part 0 - automatic comments for API call parameters
2019-03-31/a>Didier StevensMaldoc Analysis of the Weekend by a Reader
2019-02-27/a>Didier StevensMaldoc Analysis by a Reader
2018-11-18/a>Guy BruneauMultipurpose PCAP Analysis Tool
2018-10-21/a>Pasquale StirparoBeyond good ol’ LaunchAgent - part 0
2018-08-31/a>Jim ClausingQuickie: Using radare2 to disassemble shellcode
2018-06-01/a>Remco VerhoefBinary analysis with Radare2
2017-09-29/a>Lorna HutchesonGood Analysis = Understanding(tools + logs + normal)
2017-07-09/a>Russ McReeAdversary hunting with SOF-ELK
2017-04-28/a>Russell EubanksKNOW before NO
2017-01-28/a>Lorna HutchesonPacket Analysis - Where do you start?
2016-12-24/a>Didier StevensPinging All The Way
2016-10-30/a>Pasquale StirparoVolatility Bot: Automated Memory Analysis
2016-10-17/a>Didier StevensMaldoc VBA Anti-Analysis: Video
2016-10-15/a>Didier StevensMaldoc VBA Anti-Analysis
2016-05-14/a>Guy BruneauINetSim as a Basic Honeypot
2016-04-21/a>Daniel WesemannDecoding Pseudo-Darkleech (Part #2)
2015-05-03/a>Russ McReeVolDiff, for memory image differential analysis
2014-07-05/a>Guy BruneauMalware Analysis with pedump
2014-04-21/a>Daniel WesemannFinding the bleeders
2014-03-13/a>Daniel WesemannWeb server logs containing RS=^ ?
2014-01-14/a>Chris MohanSpamming and scanning botnets - is there something I can do to block them from my site?
2013-10-28/a>Daniel WesemannExploit cocktail (Struts, Java, Windows) going after 3-month old vulnerabilities
2013-06-18/a>Russ McReeVolatility rules...any questions?
2013-05-11/a>Lenny ZeltserExtracting Digital Signatures from Signed Malware
2013-03-09/a>Guy BruneauIPv6 Focus Month: IPv6 Encapsulation - Protocol 41
2013-02-03/a>Lorna HutchesonIs it Really an Attack?
2013-01-08/a>Jim ClausingCuckoo 0.5 is out and the world didn't end
2012-12-02/a>Guy BruneauCollecting Logs from Security Devices at Home
2012-09-19/a>Kevin ListonVolatility: 2.2 is Coming Soon
2012-09-14/a>Lenny ZeltserAnalyzing Malicious RTF Files Using OfficeMalScanner's RTFScan
2012-06-21/a>Russ McReeAnalysis of drive-by attack sample set
2012-06-04/a>Lenny ZeltserDecoding Common XOR Obfuscation in Malicious Code
2012-05-23/a>Mark BaggettIP Fragmentation Attacks
2012-03-03/a>Jim ClausingNew automated sandbox for Android malware
2012-02-07/a>Jim ClausingBook Review: Practical Packet Analysis, 2nd ed
2011-05-20/a>Guy BruneauSysinternals Updates, Analyzing Stuxnet Infection with Sysinternals Tools Part 3
2011-04-14/a>Adrien de BeaupreSysinternals updates, a new blog post, and webcast
2011-02-01/a>Lenny ZeltserThe Importance of HTTP Headers When Investigating Malicious Sites
2010-08-09/a>Jim ClausingFree/inexpensive tools for monitoring systems/networks
2010-07-21/a>Adrien de Beaupreautorun.inf and .lnk Malware (NOT 'Vulnerability in Windows Shell Could Allow Remote Code Execution' 2286198)
2010-05-26/a>Bojan ZdrnjaMalware modularization and AV detection evasion
2010-04-11/a>Marcus SachsNetwork and process forensics toolset
2010-03-26/a>Daniel WesemannGetting the EXE out of the RTF again
2010-02-13/a>Lorna HutchesonNetwork Traffic Analysis in Reverse
2010-01-14/a>Bojan ZdrnjaPDF Babushka
2010-01-07/a>Daniel WesemannStatic analysis of malicious PDFs
2010-01-07/a>Daniel WesemannStatic analysis of malicous PDFs (Part #2)
2009-11-25/a>Jim ClausingUpdates to my GREM Gold scripts and a new script
2009-11-03/a>Bojan ZdrnjaOpachki, from (and to) Russia with love
2009-09-25/a>Lenny ZeltserCategories of Common Malware Traits
2009-07-26/a>Jim ClausingNew Volatility plugins
2009-07-02/a>Daniel WesemannGetting the EXE out of the RTF
2009-04-15/a>Marcus Sachs2009 Data Breach Investigation Report
2009-03-13/a>Bojan ZdrnjaWhen web application security, Microsoft and the AV vendors all fail
2009-02-10/a>Bojan ZdrnjaMore tricks from Conficker and VM detection
2009-02-09/a>Bojan ZdrnjaSome tricks from Conficker's bag
2009-01-18/a>Daniel Wesemann3322. org
2009-01-15/a>Bojan ZdrnjaConficker's autorun and social engineering
2009-01-07/a>Bojan ZdrnjaAn Israeli patriot program or a trojan
2009-01-02/a>Rick WannerTools on my Christmas list.
2008-12-13/a>Jim ClausingFollowup from last shift and some research to do.
2008-11-17/a>Marcus SachsNew Tool: NetWitness Investigator
2008-11-17/a>Jim ClausingFinding stealth injected DLLs
2008-09-03/a>Daniel WesemannStatic analysis of Shellcode - Part 2
2008-07-07/a>Pedro BuenoBad url classification
2006-10-02/a>Jim ClausingReader's tip of the day: ratios vs. raw counts
2006-09-18/a>Jim ClausingLog analysis follow up
2006-09-09/a>Jim ClausingLog Analysis tips?
2006-09-09/a>Jim ClausingA few preliminary log analysis thoughts