ISC Stormcast For Thursday, February 2nd, 2023 https://isc.sans.edu/podcastdetail.html?id=8352, (Thu, Feb 2nd)

10h

Rotating Packet Captures with pfSense, (Wed, Feb 1st)

Having a new pfSense firewall in place gives some opportunities to do a bit more with the device. Maintaining some full packet captures was an item on my "to do" list. The last 24 hours is usually sufficient for me since I'm usually looking at alerts within the same day. I decided to do rotating packet captures based on file size. This allows me to...

12h

Detecting (Malicious) OneNote Files, (Wed, Feb 1st)

We are starting to see malicious OneNote documents (cfr. Xavier's diary entry "A First Malicious OneNote Document").

1d

ISC Stormcast For Wednesday, February 1st, 2023 https://isc.sans.edu/podcastdetail.html?id=8350, (Wed, Feb 1st)

1d

Packet Tuesday: Large ICMP Errors https://www.youtube.com/watch?v=z9jk8Bbf4_o , (Tue, Jan 31st)

---

1d

DShield Honeypot Setup with pfSense, (Tue, Jan 31st)

Setting up a DShield honeypot is well guided by the installation script [1]. After several minutes of following the instructions and adding some custom details, the honeypot is up and running. What's needed after that is to expose the honeypot to the internet. I recently decided to update my home router and thought it was a great opportunity to dig...

1d

ISC Stormcast For Tuesday, January 31st, 2023 https://isc.sans.edu/podcastdetail.html?id=8348, (Tue, Jan 31st)

2d

Decoding DNS over HTTP(s) Requests, (Mon, Jan 30th)

I have written before about scans for DNS over HTTP(s) (DoH) servers. DoH is now widely supported in different browsers and recursive resolvers. It has been an important piece in the puzzle to evade various censorship regimes, in particular, the "Big Chinese Firewall". Malware has at times used DoH, but often uses its own HTTP(s) based resolvers that...

2d

ISC Stormcast For Monday, January 30th, 2023 https://isc.sans.edu/podcastdetail.html?id=8346, (Mon, Jan 30th)

3d

ISC Stormcast For Friday, January 27th, 2023 https://isc.sans.edu/podcastdetail.html?id=8344, (Fri, Jan 27th)

6d