COMMAND AND CONTROL CHANNEL |
| 2016-07-26 | Johannes Ullrich | Command and Control Channels Using "AAAA" DNS Records |
COMMAND |
| 2024-07-10/a> | Jesse La Grew | Finding Honeypot Data Clusters Using DBSCAN: Part 1 |
| 2024-04-29/a> | Johannes Ullrich | D-Link NAS Device Backdoor Abused |
| 2023-06-11/a> | Guy Bruneau | DShield Honeypot Activity for May 2023 |
| 2021-02-13/a> | Guy Bruneau | vSphere Replication updates address a command injection vulnerability (CVE-2021-21976) - https://www.vmware.com/security/advisories/VMSA-2021-0001.html |
| 2021-02-05/a> | Xavier Mertens | VBA Macro Trying to Alter the Application Menus |
| 2020-02-14/a> | Xavier Mertens | Keep an Eye on Command-Line Browsers |
| 2019-07-16/a> | Russ McRee | Commando VM: The Complete Mandiant Offensive VM |
| 2018-07-30/a> | Xavier Mertens | Exploiting the Power of Curl |
| 2018-05-02/a> | Russ McRee | Windows Commands Reference - An InfoSec Must Have |
| 2016-07-26/a> | Johannes Ullrich | Command and Control Channels Using "AAAA" DNS Records |
| 2016-04-15/a> | Xavier Mertens | Windows Command Line Persistence? |
| 2015-10-12/a> | Guy Bruneau | Critical Vulnerability in Multiple Cisco Products - Apache Struts 2 Command Execution http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20131023-struts2 |
| 2013-02-17/a> | Guy Bruneau | HP ArcSight Connector Appliance and Logger Vulnerabilities |
| 2010-02-06/a> | Guy Bruneau | LANDesk Management Gateway Vulnerability |
| 2010-01-27/a> | Raul Siles | Command Line Kung Fu |
AND |
| 2024-12-17/a> | Guy Bruneau | Command Injection Exploit For PHPUnit before 4.8.28 and 5.x before 5.6.3 [Guest Diary] |
| 2024-08-23/a> | Jesse La Grew | Pandas Errors: What encoding are my logs in? |
| 2024-07-16/a> | Guy Bruneau | Who You Gonna Call? AndroxGh0st Busters! [Guest Diary] |
| 2024-07-10/a> | Jesse La Grew | Finding Honeypot Data Clusters Using DBSCAN: Part 1 |
| 2024-04-29/a> | Johannes Ullrich | D-Link NAS Device Backdoor Abused |
| 2024-02-20/a> | Xavier Mertens | Python InfoStealer With Dynamic Sandbox Detection |
| 2023-10-31/a> | Xavier Mertens | Multiple Layers of Anti-Sandboxing Techniques |
| 2023-07-01/a> | Russ McRee | Sandfly Security |
| 2023-06-11/a> | Guy Bruneau | DShield Honeypot Activity for May 2023 |
| 2023-05-24/a> | Tom Webb | IR Case/Alert Management |
| 2023-03-12/a> | Guy Bruneau | AsynRAT Trojan - Bill Payment (Pago de la factura) |
| 2022-09-26/a> | Xavier Mertens | Easy Python Sandbox Detection |
| 2022-08-22/a> | Xavier Mertens | 32 or 64 bits Malware? |
| 2022-06-03/a> | Xavier Mertens | Sandbox Evasion... With Just a Filename! |
| 2021-12-06/a> | Xavier Mertens | The Importance of Out-of-Band Networks |
| 2021-04-02/a> | Xavier Mertens | C2 Activity: Sandboxes or Real Victims? |
| 2021-02-13/a> | Guy Bruneau | vSphere Replication updates address a command injection vulnerability (CVE-2021-21976) - https://www.vmware.com/security/advisories/VMSA-2021-0001.html |
| 2021-02-05/a> | Xavier Mertens | VBA Macro Trying to Alter the Application Menus |
| 2020-09-16/a> | Johannes Ullrich | Do Vulnerabilities Ever Get Old? Recent "Mirai" Variant Scanning for 20 Year Old Amanda Version? |
| 2020-09-03/a> | Xavier Mertens | Sandbox Evasion Using NTP |
| 2020-04-16/a> | Johannes Ullrich | Using AppLocker to Prevent Living off the Land Attacks |
| 2020-02-14/a> | Xavier Mertens | Keep an Eye on Command-Line Browsers |
| 2020-02-07/a> | Xavier Mertens | Sandbox Detection Tricks & Nice Obfuscation in a Single VBScript |
| 2019-07-16/a> | Russ McRee | Commando VM: The Complete Mandiant Offensive VM |
| 2019-01-10/a> | Brad Duncan | Heartbreaking Emails: "Love You" Malspam |
| 2018-08-01/a> | Johannes Ullrich | When Cameras and Routers attack Phones. Spike in CVE-2014-8361 Exploits Against Port 52869 |
| 2018-07-30/a> | Xavier Mertens | Exploiting the Power of Curl |
| 2018-07-24/a> | Brad Duncan | Recent Emotet activity |
| 2018-05-02/a> | Russ McRee | Windows Commands Reference - An InfoSec Must Have |
| 2017-01-06/a> | John Bambenek | Great Misadventures of Security Vendors: Absurd Sandboxing Edition |
| 2017-01-05/a> | John Bambenek | New Year's Resolution: Build Your Own Malware Lab? |
| 2016-12-10/a> | Didier Stevens | Sleeping VBS Really Wants To Sleep |
| 2016-07-26/a> | Johannes Ullrich | Command and Control Channels Using "AAAA" DNS Records |
| 2016-06-22/a> | Bojan Zdrnja | Security through obscurity never works |
| 2016-05-02/a> | Rick Wanner | Fake Chrome update for Android |
| 2016-04-15/a> | Xavier Mertens | Windows Command Line Persistence? |
| 2015-12-16/a> | Xavier Mertens | Playing With Sandboxes Like a Boss |
| 2015-12-05/a> | Guy Bruneau | Are you looking to setup your own Malware Sandbox? |
| 2015-12-04/a> | Tom Webb | Automating Phishing Analysis using BRO |
| 2015-10-12/a> | Guy Bruneau | Critical Vulnerability in Multiple Cisco Products - Apache Struts 2 Command Execution http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20131023-struts2 |
| 2015-07-28/a> | Rick Wanner | Android Stagefright multimedia viewer prone to remote exploitation |
| 2015-04-27/a> | Richard Porter | When Prevention Fails, Incident Response Begins |
| 2014-09-12/a> | Chris Mohan | Are credential dumps worth reviewing? |
| 2014-08-12/a> | Adrien de Beaupre | Host discovery with nmap |
| 2014-08-04/a> | Russ McRee | Threats & Indicators: A Security Intelligence Lifecycle |
| 2014-05-01/a> | Johannes Ullrich | Microsoft Announces Special Patch for IE 0-day (Win XP included!) |
| 2014-04-26/a> | Guy Bruneau | Android Users - Beware of Bitcoin Mining Malware |
| 2014-04-05/a> | Jim Clausing | Those strange e-mails with URLs in them can lead to Android malware |
| 2014-04-01/a> | Basil Alawi S.Taher | Upgrading Your Android, Elevating My Malware |
| 2014-03-11/a> | Basil Alawi S.Taher | Introduction to Memory Analysis with Mandiant Redline |
| 2014-02-10/a> | Rob VandenBrink | Isn't it About Time to Get Moving on Chip and PIN? |
| 2014-02-07/a> | Rob VandenBrink | New ISO Standards on Vulnerability Handling and Disclosure |
| 2014-01-23/a> | Chris Mohan | Learning from the breaches that happens to others Part 2 |
| 2013-12-05/a> | Mark Hofman | Updated Standards Part 1 - ISO 27001 |
| 2013-09-23/a> | Rob VandenBrink | How do you spell "PSK"? |
| 2013-02-22/a> | Chris Mohan | PHP 5.4.12 and PHP 5.3.22 released http://www.php.net/ChangeLog-5.php |
| 2013-02-17/a> | Guy Bruneau | HP ArcSight Connector Appliance and Logger Vulnerabilities |
| 2013-01-30/a> | Richard Porter | Getting Involved with the Local Community |
| 2013-01-14/a> | Richard Porter | January 2013 Microsoft Out of Cycle Patch |
| 2013-01-08/a> | Jim Clausing | Cuckoo 0.5 is out and the world didn't end |
| 2012-12-13/a> | Johannes Ullrich | What if Tomorrow Was the Day? |
| 2012-10-24/a> | Russ McRee | Cyber Security Awareness Month - Day 24 - A Standard for Information Security Incident Management - ISO 27035 |
| 2012-10-23/a> | Rob VandenBrink | Cyber Security Awareness Month - Day 23: Character Encoding Standards - ASCII and Successors |
| 2012-10-17/a> | Rob VandenBrink | Cyber Security Awareness Month - Day 17 - A Standard for Risk Management - ISO 27005 |
| 2012-10-12/a> | Mark Hofman | Cyber Security Awareness Month - Day 12 PCI DSS |
| 2012-10-11/a> | Rob VandenBrink | Cyber Security Awareness Month - Day 11 - Vendor Agnostic Standards (Center for Internet Security) |
| 2012-10-09/a> | Johannes Ullrich | Cyber Security Awreness Month - Day 9 - Request for Comment (RFC) |
| 2012-05-18/a> | Johannes Ullrich | ZTE Score M Android Phone backdoor |
| 2012-04-23/a> | Russ McRee | Emergency Operations Centers & Security Incident Management: A Correlation |
| 2012-03-03/a> | Jim Clausing | New automated sandbox for Android malware |
| 2011-11-03/a> | Richard Porter | An Apple, Inc. Sandbox to play in. |
| 2011-11-01/a> | Russ McRee | Honeynet Project: Android Reverse Engineering (A.R.E.) Virtual Machine released |
| 2011-10-29/a> | Richard Porter | The Sub Critical Control? Evidence Collection |
| 2011-09-15/a> | Johannes Ullrich | SSH Vandals? |
| 2011-09-07/a> | Lenny Zeltser | Analyzing Mobile Device Malware - Honeynet Forensic Challenge 9 and Some Tools |
| 2011-05-18/a> | Bojan Zdrnja | Android, HTTP and authentication tokens |
| 2011-03-22/a> | Chris Mohan | Read only USB stick trick |
| 2011-03-03/a> | Manuel Humberto Santander Pelaez | Rogue apps inside Android Marketplace |
| 2011-01-08/a> | Guy Bruneau | PandaLabs 2010 Annual Report |
| 2010-12-31/a> | Bojan Zdrnja | Android malware enters 2011 |
| 2010-11-19/a> | Jason Lam | Adobe Reader X - Sandbox |
| 2010-10-19/a> | Rob VandenBrink | Cyber Security Awareness Month - Day 19 - VPN and Remote Access Tools |
| 2010-08-04/a> | Tom Liston | Incident Reporting - Liston's "How-To" Guide |
| 2010-07-25/a> | Rick Wanner | Updated version of Mandiant's Web Historian |
| 2010-07-21/a> | Adrien de Beaupre | Adobe Reader Protected Mode |
| 2010-02-07/a> | Rick Wanner | Mandiant Mtrends Report |
| 2010-02-06/a> | Guy Bruneau | LANDesk Management Gateway Vulnerability |
| 2010-01-27/a> | Raul Siles | Command Line Kung Fu |
| 2010-01-21/a> | Chris Carboni | * Microsoft Out Of Band Patch Release |
| 2010-01-11/a> | Johannes Ullrich | Fake Android Application |
| 2009-07-24/a> | Rick Wanner | Microsoft Out of Band Patch |
| 2009-06-11/a> | Rick Wanner | WHO Declares Flu A(H1N1) a Pandemic |
| 2009-05-19/a> | Rick Wanner | New Version of Mandiant Highlighter |
| 2009-05-01/a> | Adrien de Beaupre | Incident Management |
| 2009-04-26/a> | Johannes Ullrich | Pandemic Preparation - Swine Flu |
| 2009-04-16/a> | Adrien de Beaupre | Incident Response vs. Incident Handling |
| 2009-04-07/a> | Johannes Ullrich | Common Apache Misconception |
| 2009-02-05/a> | Rick Wanner | Mandiant Memoryze review, Hilighter, other Mandiant tools! |
| 2008-11-25/a> | Andre Ludwig | Tmobile G1 handsets having DNS problems? |
| 2008-10-29/a> | Deborah Hale | Day 29 - Should I Switch Software Vendors? |
| 2008-10-23/a> | Mark Hofman | Microsoft out-of-band patch - Severity Critical |
| 2008-09-09/a> | Swa Frantzen | wordpress upgrade |
| 2008-08-09/a> | Deborah Hale | Cleveland Outage |
CONTROL |
| 2024-04-22/a> | Jan Kopriva | It appears that the number of industrial devices accessible from the internet has risen by 30 thousand over the past three years |
| 2022-05-03/a> | Rob VandenBrink | Finding the Real "Last Patched" Day (Interim Version) |
| 2021-07-08/a> | Xavier Mertens | Using Sudo with Python For More Security Controls |
| 2021-05-12/a> | Jan Kopriva | Number of industrial control systems on the internet is lower then in 2020...but still far from zero |
| 2019-10-19/a> | Russell Eubanks | What Assumptions Are You Making? |
| 2019-07-25/a> | Rob VandenBrink | When Users Attack! Users (and Admins) Thwarting Security Controls |
| 2019-07-18/a> | Rob VandenBrink | The Other Side of Critical Control 1: 802.1x Wired Network Access Controls |
| 2017-07-24/a> | Russell Eubanks | Trends Over Time |
| 2017-06-10/a> | Russell Eubanks | An Occasional Look in the Rear View Mirror |
| 2016-11-23/a> | Tom Webb | Mapping Attack Methodology to Controls |
| 2016-10-08/a> | Russell Eubanks | Unauthorized Change Detected! |
| 2016-07-26/a> | Johannes Ullrich | Command and Control Channels Using "AAAA" DNS Records |
| 2015-12-21/a> | Daniel Wesemann | Critical Security Controls: Getting to know the unknown |
| 2015-11-04/a> | Richard Porter | Application Aware and Critical Control 2 |
| 2015-05-29/a> | Russell Eubanks | Trust But Verify |
| 2014-10-13/a> | Lorna Hutcheson | For or Against: Port Security for Network Access Control |
| 2014-08-17/a> | Rick Wanner | Part 2: Is your home network unwittingly contributing to NTP DDOS attacks? |
| 2014-07-28/a> | Guy Bruneau | Management and Control of Mobile Device Security |
| 2014-06-11/a> | Daniel Wesemann | Help your pilot fly! |
| 2014-02-10/a> | Rob VandenBrink | A Tale of Two Admins (and no Change Control) |
| 2013-09-02/a> | Guy Bruneau | Multiple Cisco Security Notice |
| 2013-03-13/a> | Mark Baggett | Wipe the drive! Stealthy Malware Persistence Mechanism - Part 1 |
| 2012-12-31/a> | Manuel Humberto Santander Pelaez | How to determine which NAC solutions fits best to your needs |
| 2012-11-23/a> | Rob VandenBrink | What's in Your Change Control Form? |
| 2011-11-03/a> | Richard Porter | An Apple, Inc. Sandbox to play in. |
| 2011-10-29/a> | Richard Porter | The Sub Critical Control? Evidence Collection |
| 2011-10-28/a> | Daniel Wesemann | Critical Control 20: Security Skills Assessment and Training to fill Gaps |
| 2011-10-27/a> | Mark Baggett | Critical Control 18: Incident Response Capabilities |
| 2011-10-26/a> | Rick Wanner | Critical Control 17:Penetration Tests and Red Team Exercises |
| 2011-10-17/a> | Rob VandenBrink | Critical Control 11: Account Monitoring and Control |
| 2010-08-22/a> | Rick Wanner | Failure of controls...Spanair crash caused by a Trojan |
| 2010-08-19/a> | Rob VandenBrink | Change is Good. Change is Bad. Change is Life. |
| 2010-08-05/a> | Rob VandenBrink | Access Controls for Network Infrastructure |
| 2010-06-14/a> | Manuel Humberto Santander Pelaez | Python on a microcontroller? |
| 2010-06-07/a> | Manuel Humberto Santander Pelaez | Software Restriction Policy to keep malware away |
| 2009-10-22/a> | Adrien de Beaupre | Cyber Security Awareness Month - Day 22 port 502 TCP - Modbus |
CHANNEL |
| 2016-07-26/a> | Johannes Ullrich | Command and Control Channels Using "AAAA" DNS Records |
| 2013-08-21/a> | Rob VandenBrink | Fibre Channel Reconnaissance - Reloaded |
