Szolgáltatóknak

Companies need to update their security awareness training efforts to meet the new realities of Generative AI.

I am TA-ing for Taz for the new SANS FOR577 class again and I figured it was time to release some fixes to my le-hex-to-ip.py script that I wrote up last fall while doing the same. I still plan to make some additional updates to the script to be able to take the hex strings from stdin, but in the meantime, figured I should release this fix. I was already using Python3's inet_ntoa() function to convert the IPv4 address, so I simplified the script by using the inet_ntop() function since it can handle both the IPv4 and IPv6 addresses instead of my kludgy handling of the IPv6. As a side-effect it also quite nicely handles the IPv4-mapped IPv6 addresses (of the form ::ffff:192.168.1.75).

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

The reason I extracted a PE file in my last diary entry, is that I discovered it was the dropper of a Cobalt Strike beacon @DebugPrivilege had pointed me to. My 1768.py tool crashed on the process memory dump. This is fixed now, but it still doesn't extract the configuration.

Multiple attacks exploit vulnerabilities in an IT remote access tool to deliver a variety of different payloads into business environments.

The U.S.-led global guidance notes the need for vulnerability management and data protection.

Google Mandiant says APT29 targeted German politicians and is a threat to Western political parties.

How to gain the insights necessary to change security policies as active adversaries persist.

Any computer on which BIND will be running is likely to have several interfaces, each of which may have multiple IP addresses; both IPv4 and IPv6. When the named process is started it needs to know which of these addresses it should be using for the various jobs it needs to perform. There are several configuration statements that control what named wants to use and how it discovers what's available to be used. These are: listen-on for IPv4 addresses. listen-on-v6 for IPv6 addresses. query-sourc ...