INTERNET STORM CENTER SPOTLIGHT
ISC provides a free analysis and warning service to thousands of Internet users and organizations, and is actively working with Internet Service Providers to fight back against the most malicious attackers. https://isc.sans.edu/about.html
SRUM-DUMP Version 3: Uncovering Malware Activity in Forensics
Published: 2025-04-27
Last Updated: 2025-04-28 00:21:25 UTC
by Mark Baggett (Version: 2)
For digital forensics and incident response professionals, extracting precise evidence from Windows systems is critical to understanding and mitigating threats. I'm excited to introduce SRUM-DUMP Version 3, a powerful forensic tool I've developed to analyze the Windows System Resource Usage Monitor (SRUM) database. Available on GitHub at SRUM-DUMP Repository, this version offers significant improvements, including a user-friendly GUI and customizable output. In this post, I'll guide you through using SRUM-DUMP v3Õs GUI to investigate a scenario where malware (malware<.>exe) exfiltrates intellectual property over a wireless network. We'll explore the 3-step wizard, customize the analysis to highlight malware<.>exe, and examine where it appears in the output spreadsheet and what each tab reveals about the incident ...
Read the full entry:
https://isc.sans.edu/diary/SRUMDUMP+Version+3+Uncovering+Malware+Activity+in+Forensics/31896/
Steganography Analysis With pngdump.py
Published: 2025-04-26
Last Updated: 2025-04-26 06:45:13 UTC
by Didier Stevens (Version: 1)
I like it when a diary entry like "Example of a Payload Delivered Through Steganography" (https://isc.sans.edu/diary/Example+of+a+Payload+Delivered+Through+Steganography/31892/) is published: it gives me an opportunity to test my tools, in particular pngdump.py, a tool to analyze PNG files.
A PNG file consists of a header followed by chunks. pngdump.py shows this ...
Read the full entry:
https://isc.sans.edu/diary/Steganography+Analysis+With+pngdumppy/31894/
More Scans for SMS Gateways and APIs
Published: 2025-04-29
Last Updated: 2025-04-29 15:25:05 UTC
by Johannes Ullrich (Version: 1)
Last week, I wrote about scans for Teltonika Networks SMS Gateways. Attackers are always looking for cheap (free) ways to send SMS messages and gain access to not-blocklisted numbers. So, I took a closer look at similar scans we have seen.
There are numerous ways to send SMS messages; using a hardware SMS gateway is probably one of the more fancy ways to do so. Most websites use messaging services. For example, we do see scans for SMS plugins for WordPress:
These scans look for style sheet files (.css) that are part of the respective plugins. It is fair to assume that if the respective style sheet is present, the attacker will attempt to obtain access to the site ...
Read the full entry: https://isc.sans.edu/diary/More+Scans+for+SMS+Gateways+and+APIs/31902/