Published file metadata, source observations, indicators, and research history in one bounded catalog.
10Reachable catalog records
1 / 1Current catalog page
24Maximum records per page
0Samples downloaded by this page
Feed collection status
Sources represented on this page. Publication and observation dates describe the content; successful batch dates describe local collection. A recent batch does not certify complete coverage or current provider availability.
src_6c4986274fbcd01a16Collection status unverifiedLast successful batch: Unverified
Stale means older than twice the recorded collection interval, with a minimum of one hour; without an interval, the threshold is 24 hours. Cached content remains available while a feed is stale, paused, or unverified.
10 MATCHING RECORDSMETADATA ONLY / SOURCE ATTRIBUTION PRESERVED
Today, I published the following diary on isc.sans.edu: “Show me All Your Windows!“: It’s a key point for attackers to implement anti-debugging and anti-analysis techniques. Anti-debugging means the malware will try to detect if it’s being debugged (executed in a debugger or its execution is slower than expected). Anti-analysis refers The post [SANS ISC] Show me All Your Windows! appeared first on
First reported Aug 11, 2023 09:02 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
[Edit: Sorry for the “bullet-point” style, it was a lot of details to compile in this blog post] We were back at the Alvisse Parc Hotel after a break of four years! In 2022, only a light CTI summit was organized (see my wrap-up), but this year, hack.lu was back The post Hack.lu 2023 Wrap-Up appeared first on /dev/random.
First reported Oct 19, 2023 21:36 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
Today, I published the following diary on isc.sans.edu: “More Exotic Excel Files Dropping AgentTesla”: Excel is an excellent target for attackers. The Microsoft Office suite is installed on millions of computers, and people trust these files. If we have the classic xls, xls, xlsm file extensions, Excel supports many others! The post [SANS ISC] More Exotic Excel Files Dropping AgentTesla appeared f
First reported Aug 23, 2023 07:27 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
Today, I published the following diary on isc.sans.edu: “Are Leaked Credentials Dumps Used by Attackers?“: Leaked credentials are a common thread for a while. Popular services like “Have I Been Pwned” help everyone know if some emails and passwords have been leaked. This is a classic problem: One day, you create an account The post [SANS ISC] Are Leaked Credentials Dumps Used by Attackers? appeare
First reported Aug 04, 2023 07:52 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
Today, I published the following diary on isc.sans.edu: “Python Malware Using Postgresql for C2 Communications“: For modern malware, having access to its C2 (Command and control) is a crucial point. There are many ways to connect to a C2 server using tons of protocols, but today, HTTP remains very common The post [SANS ISC] Python Malware Using Postgresql for C2 Communications appeared first on /d
First reported Aug 25, 2023 08:57 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
Today, I published the following diary on isc.sans.edu: “Do Attackers Pay More Attention to IPv6?“: IPv6 has always been a hot topic! Available for years, many ISP’s deployed IPv6 up to their residential customers. In Belgium, we were for a long time, the top-one country with IPv6 deployment because all The post [SANS ISC] Do Attackers Pay More Attention to IPv6? appeared first on /dev/random.
First reported Jul 29, 2023 13:16 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
Today, I published the following diary on isc.sans.edu: “From a Zalando Phishing to a RAT“: Phishing remains a lucrative threat. We get daily emails from well-known brands (like DHL, PayPal, Netflix, Microsoft, Dropbox, Apple, etc). Recently, I received a bunch of phishing emails targeting Zalando customers. Zalando is a German The post [SANS ISC] From a Zalando Phishing to a RAT appeared first on
First reported Aug 18, 2023 06:22 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
Today, I published the following diary on isc.sans.edu: “Quick Malware Triage With Inotify Tools“: When you handle a lot of malicious files, you must have a process and tools in place to speedup the analysis. It’s impossible to investigate all files and a key point is to find interesting files The post [SANS ISC] Quick Malware Triage With Inotify Tools appeared first on /dev/random.
First reported Aug 21, 2023 06:43 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
Today, I published the following diary on isc.sans.edu: “macOS: Who’s Behind This Network Connection?“: When you must investigate suspicious behavior or work on an actual incident, you could be asked to determine who’s behind a network connection. From a pure network point of view, your firewall or any network security The post [SANS ISC] macOS: Who’s Behind This Network Connection? appeared first
First reported Aug 26, 2023 10:59 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
Today, I published the following diary on isc.sans.edu: “Have You Ever Heard of the Fernet Encryption Algorithm?“: In cryptography, there is a gold rule that states to not develop your own algorithm because… it will be probably weak and broken! They are strong algorithms (like AES) that do a great job The post [SANS ISC] Have You Ever Heard of the Fernet Encryption Algorithm? appeared first on /de
First reported Aug 22, 2023 08:35 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
A filename, label, or report mention alone does not establish maliciousness. Observation dates describe cited sources; collection dates describe this local metadata catalog. No malware samples are stored, fetched, or executed by these pages.