ISC Stormcast For Friday, October 16th, 2026...
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
View ArticleSmall Agents, Smaller Blast Radius: Controlling What AI Can Do, (Fri, Oct 16th)
I believe the cybersecurity industry may be approaching AI security the wrong way. AI agents are becoming more powerful every day. Systems like ChatGPT, Claude, and Grok can write and execute code, use...
View ArticleISC Stormcast For Thursday, October 15th, 2026...
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
View ArticleClik here to view.
Panchan's Mining Island [Guest Diary], (Wed, Oct 14th)
[This is a Guest Diary by Zachary Norwood, an ISC intern as part of the SANS.edu BACS program] Crypto mining malware has been active and spreading across the internet for quite some time now. Moreover,...
View ArticleClik here to view.
Orphaned VBA Projects Inside DWG Files, (Wed, Oct 14th)
Years ago I wrote diary entries about VBA code stored inside AutoCAD drawing files (.dwg). In a nutshell: the VBA code is stored inside an OLE file, that is embedded inside the DWG file. You can do a...
View ArticleISC Stormcast For Wednesday, October 14th, 2026...
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
View ArticleOctober 2026 Microsoft Patch Tuesday, (Tue, Oct 13th)
Microsoft today released patches for 1,417 vulnerabilities. 76 of these vulnerabilities are rated critical, with 7 critical vulnerabiilties requiring no customer actions. One vulnerability was...
View ArticleISC Stormcast For Tuesday, October 13th, 2026...
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
View ArticleISC Stormcast For Monday, October 12th, 2026...
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
View ArticleClik here to view.
Why TLP should not replace your internal information classification, (Sat,...
The Traffic Light Protocol (TLP)[1], which is now in its second incarnation, is a wonderful standard that enables one to easily communicate whether information may be shared further (and if so, how...
View ArticleISC Stormcast For Friday, October 9th, 2026...
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
View ArticleReconstructing AI Agent Activity: Two New Scripts for Forensic Review, (Thu,...
We just did a major update to FOR577 and added a lot of new material on day 5 about investigating AI usage in incident response. In the new material we dicsuss 8 of the most popular AI coding...
View ArticleISC Stormcast For Thursday, October 8th, 2026...
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
View ArticleScans for Atlassian vulnerablity (CVE-2026-21589), (Wed, Oct 7th)
On October 5th, Atlassian published patches for multiple products to fix an "Arbitrary File Access" vulnerability [CVE-2026-21589]. An attacker can read arbitrary files in the web application's...
View ArticleISC Stormcast For Wednesday, October 7th, 2026...
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
View ArticleClik here to view.
More RMM Tools In the Wild, (Tue, Oct 6th)
It seems that a trend started… I continue my journey discovering more RMM ("Remote Management & Monitoring") tools abused by threat actors! A few days ago, I wrote a diary[1] about ScreenConnect...
View ArticleISC Stormcast For Tuesday, October 6th, 2026...
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
View ArticleISC Stormcast For Monday, October 5th, 2026...
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
View ArticleClik here to view.
TTY Logs and the Data it Captures, (Sun, Oct 4th)
For an experiment, I created a script [1] that parses and send the TTY logs collected from actors or bots activity that run various commands after they successfully login the DShield sensor. Those TTY...
View ArticleClik here to view.
User Agent Strings Curiosities, (Sun, Oct 4th)
Sometimes I have to smile, or my interest is triggered, when I review new User Agent Strings in the honeypot logs. Like when I see an "authorized" scan: Or when I'm owned for the umpteenth time: I...
View Article
