INTERNET STORM CENTER SPOTLIGHT
INTERNET STORM CENTER SPOTLIGHT
ISC provides a free analysis and warning service to thousands of Internet users and organizations, and is actively working with Internet Service Providers to fight back against the most malicious attackers. https://isc.sans.edu/about.html
Infostealer Malware with Double Extension
Published: 2022-12-18
Last Updated: 2022-12-18 17:28:06 UTC
by Guy Bruneau (Version: 1)
Got this file attachment this week pretending to be from HSBC Global Payments and Cash Management. The attachment payment_copy.pdf.z is a rar archive, kind of unusual with this type of file archive but when extracted, it comes out as a double extension with pdf.exe. The file is a trojan infostealer and detected by multiple scanning engines.
Read the full diary entry:
https://isc.sans.edu/diary/Infostealer+Malware+with+Double+Extension/29354/
Linux File System Monitoring & Actions
Published: 2022-12-20
Last Updated: 2022-12-20 06:45:13 UTC
by Xavier Mertens (Version: 1)
There can be multiple reasons to keep an eye on a critical/suspicious file or directory. For example, you could track an attacker and wait for some access to the captured credentials in a phishing kit installed on a compromised server. You could deploy an EDR solution or an OSSEC agent that implements an FIM (‘File Integrity Monitoring”)[1]. Upon a file change, an action can be triggered. Nice, but what if you would like a quick solution but agentless? (In the scope of an incident, for example)
There is a well-known suite of API calls on Linux that track filesystem changes: inotify[2]. Around the API, a set of tools are available, like “inotifywatch” that generates an event when a file is “accessed”
Read the full diary entry:
https://isc.sans.edu/diary/Linux+File+System+Monitoring+Actions/29362/