SANS Internet Storm Center

Building your malware analysis lab is a key point before playing with malware. Today, thanks to virtualization, it's convenient to play with snapshots in your lab. Start a new investigation from a clean snapshot and take some more when you reached a critical step. But, if you need to revert to a previous snapshot, all changes applied to the VM are... lost! Therefore, it's important to store important data outside the VM.

Introduction

Apple today released patches for 304 vulnerabilties. This number is still in line with prior Apple updates, and comes just about a month after the last apple update.

[This is a Guest Diary by Jeffray Spence, an ISC intern as part of the SANS.edu BACS program]

YARA-X's 1.22.0 release brings 11 improvements and 9 bugfixes.

Yesterday everyone was running around like crazy (me included :) because of the php2shell vulnerability.

This morning, we returned to Infocon Green. As usual, we are raising the Infocon to alert you to emerging situations requiring immediate attention. PHP fit that description. By now, you either know about it, or you probably never will, so it is time to go back to "business as usual".

PHP.net announced that it will release a critical update today. We decided to change the infoCon to YELLOW due to the widespread use of PHP, the expected severity of the flaw (CVSS 9.4), and the availability of early PoC exploits before the patch became available. 

Here is the YARA rule I used to detect "Orphaned VBA Projects Inside DWG Files".

I believe the cybersecurity industry may be approaching AI security the wrong way.

[This is a Guest Diary by Zachary Norwood, an ISC intern as part of the SANS.edu BACS program]