Sans News Feed
- ISC Stormcast For Monday, October 5th, 2026 https://isc.sans.edu/podcastdetail/10122, (Mon, Oct 5th) October 5, 2026
- TTY Logs and the Data it Captures, (Sun, Oct 4th) October 5, 2026For an experiment, I created a script [1] that parses and send the TTY logs collected from actors or bots activity that run various commands after they successfully login the DShield sensor. Those TTY logs are sent daily at the end of each day to the DShield SIEM [2] to be correlated with all the […]
- User Agent Strings Curiosities, (Sun, Oct 4th) October 4, 2026Sometimes I have to smile, or my interest is triggered, when I review new User Agent Strings in the honeypot logs.
- YARA-X 1.21.0 Release, (Sat, Oct 3rd) October 3, 2026YARA-X's 1.21.0 release brings 5 improvements and 4 bugfixes.
- ISC Stormcast For Friday, October 2nd, 2026 https://isc.sans.edu/podcastdetail/10120, (Fri, Oct 2nd) October 2, 2026
- ScreenConnect Client (Ab)used by Attackers, (Thu, Oct 1st) October 1, 2026Threat Actors do not always use top-notch techniques or very complex malware to perform their attacks. Sometimes, they just abuse of existing applications...
- ISC Stormcast For Thursday, October 1st, 2026 https://isc.sans.edu/podcastdetail/10118, (Thu, Oct 1st) October 1, 2026
- ISC Stormcast For Wednesday, September 30th, 2026 https://isc.sans.edu/podcastdetail/10116, (Wed, Sep 30th) September 30, 2026
- Scans for Wordfence Protected Websites, (Tue, Sep 29th) September 29, 2026Starting yesterday, our sensors picked up a small number of scans for "wordfence-waf.php". This particular script is used by Wordfence, a solution to protect WordPress sites. During the Wordfence install, the wordpress-waf.php file will be created in the site's root directory [1].
- ISC Stormcast For Tuesday, September 29th, 2026 https://isc.sans.edu/podcastdetail/10114, (Tue, Sep 29th) September 29, 2026