Posts
-
CVE-2026-70111: The Crash That Was Almost Nothing
Microsoft patched CVE-2026-70111 yesterday. The Corelight blog post covers the what: unauthenticated remote kernel DoS on Windows Server 2019/2022/2025 via a malformed DFS referral response, no auth required, domain controllers included. This is the how. Why DFS We’ve been systematically fuzzing MS-RPC interfaces. Enumerate the registered endpoints, walk the opnums, throw shaped garbage at each one, watch for crashes. About 1,000 interfaces, ~10,000 functions. Most return access denied or do nothing interesting. DFS got bumped...
Read more...
-
CVE-2026-41089: Chasing a Ghost Through Netlogon
Microsoft’s May 2026 patch for CVE-2026-41089 fixed a byte/WCHAR mismatch in Netlogon’s CLDAP response serialization. Textbook buffer overflow on Domain Controllers, rated CVSS 9.8. Yeray at ADscan published an excellent patch-diff showing exactly what changed. We wanted to answer a different question: is this actually exploitable, and if so, how? The Server-Side Reality The public narrative (unauthenticated UDP packet crashes LSASS on any DC) doesn’t hold up in practice. Through lab reproduction and binary analysis,...
Read more...
-
The Port Scoping Paradox: When Optimization Makes Things Slower
TL;DR: Port scoping in Suricata rules — a widely recommended optimization — can actually increase CPU usage by 20-30% when the traffic you’re analyzing is already on the target ports. Here’s the story of how I discovered this counterintuitive behavior and what it means for rule development. The Setup: An “Obvious” Optimization You’re writing Suricata detection rules for RDP brute force attacks. Your starting point looks like this: alert tcp any any -> any any...
Read more...
-
CVE-2025-8088: WinRAR NTFS ADS Path Traversal
I was catching up on weekend news when ESET’s report landed covering another RAR file path traversal. Initial coverage was careful about not describing the mechanism — understandably — but there’s a fake PoC on GitHub that has nothing to do with the actual CVE (the author couldn’t resist the SEO, much like this author). I found one of the file hashes submitted to any.run and went from there. At first nothing looked obviously wrong...
Read more...
-
Forcing impacket and Metasploit to use SMB2
When I’m building detection rules for specific SMB traffic patterns, I need the tools generating test traffic to cooperate. impacket defaults to SMB3. Metasploit follows suit. Here’s how to push both down to SMB2. impacket The dialect preference lives in impacket/smbconnection.py around line 79. Change the preferredDialect parameter: self._SMBConnection = smb3.SMB3(self._remoteName, self._remoteHost, self._myName, hostType, self._sess_port, self._timeout, preferredDialect=SMB2_DIALECT_21) Available constants: SMB2_DIALECT_002 — SMB 2.0.2 SMB2_DIALECT_21 — SMB 2.1 (what I use) Metasploit Disable SMB encryption to...
Read more...
-
Hunting for browser extension abuse
I came across a funny thing while digging into discord stealers. The world of discord stealers is very much in the business of cryptocurrency theft, and because many crypto wallets are browser extensions, this class of attack frequently looks for extension ID strings to inject malicious javascript into. I added a new set to the TGI HUNT rules to detect these browser extension ID strings in HTTP. For example, here is 1336 stealer v3: To...
Read more...
-
Arbitrary File Read in Jenkins via args4j (CVE-2024-23897)
Please note that this analysis covers the vulnerability of @ expansion, not the entire attack chain possible from the advisory. Background The hot thing in the security press this morning (25 JAN 2024) is a vulnerability in Jenkins allowing attackers to read arbitrary files. Jenkins has had a few vulnerabilities over the years, likely due to its incredible popularity and dominant marketshare in the CI/CD space inviting much code analysis and scrutiny. The large market...
Read more...
-
TGI HUNT Ruleset Update
Hey all, I’ve decided to start being more verbose about this project’s activity in the hope of generating more feedback from people checking it out. Documentation Documentation will slowly appear in the ruleset as reference links to this site. If there is a particular rule you’d like to know more about, simply open a github issue here and I will bump it to the top of the documentation queue. Ruleset Housekeeping cleaned up spacing removed...
Read more...
-
Easily Assemble Regular Expressions
List to regular expression Have you ever encountered a list like this and thought “I wish I could easily create a regex to cover all these possible values”? source I have a linux based method to share which makes this task easy by using an incredible Perl module called Regexp::Assemble Step 1 - create a list In our example, We’d like to capture all the possible values behind the ${ characters (we’ll deal with the...
Read more...
-
Behavorial xbits with Suricata
The Setting While attempting to build detection for DeepRats as revealed by @benkow_, I managed to have (what I think) is a pretty good idea about using xbits. I’ll admit its a bit basic but I think sometimes the best ideas are deceivingly simple. The Idea 1.) observe potentially malicious behavior, set an xbit 2.) observe another potentially malicious behavior, set another xbit 3.) build detection consisting of a good fast_pattern match and xbits checks...
Read more...
-
2032936 - Suspected Sliver DNS CnC FP Report
Background It appears that SMTP MTAs and SMTP spam gateways utilizing DKIM sometimes make many _domainkey DNS TXT requests, which occasionally generate a false positive alert (FP) for rule 2032936. The cause of these alerts is a bit of inexact rule logic, which sometimes matches legitimate requests greater than a certain length that start with the underscore character: content:"_"; depth:1; content:"_domainkey"; distance:8; For example, this non-malicious request generates a FP: _conversica._domainkey.servicios.redactado.com This example request would...
Read more...
-
Cobalt Group Report
Update/correction It has been brought to my attention that the attribution of this activity to cobalt group is not ironclad, it may change in the future. Recently an excellent report by Checkpoint was published explaining recent developments of the Cobalt Group threat actor group. The Checkpoint report covers a lot of interesting TTPs and the evolution of techniques and procedures, but for now we will focus on detecting the unique C2 used by the group....
Read more...
-
Machete Malware Unsheathed
Following on the excellent reporting by ESET, I decided to have a look at the malware myself to see if I could tease out Suricata signatures. The sample I found was a SFX Rar file that launched another SFX Rar containing several py2exe files: ;El comentario siguiente contiene secuencias de órdenes para auto extracción Setup=GoogleCrash.exe TempMode Silent=1 Overwrite=1 Within the decompiled exe files, we can see the python code used to generate the network activity,...
Read more...
-
About the Anubis Sinkhole
A question that frequently comes up is: “What is the Anubis Networks Sinkhole, and what does it mean when I see IDS alerts for it?”. What is a Sinkhole? When you type a domain name like “google.com” into your browser’s address bar, your computer generates a DNS request to turn that name into an IP address. The same process happens when your computer is infected with a malicious program, and that program wants to communicate...
Read more...
-
Online Safety - Top 10 Tips
These are my top tips for remaining safe online: Only install apps from the default authorized app store Never install something because you are asked to Never open unexpected email attachments Check links in email before clicking Use 2 factor authentication for banking and email logins Use a password manager Don’t reuse passwords If you think something is a scam, search the web for similar scams Use antivirus software, but know it is a 65%...
Read more...
-
AutoIDS vs SIGPIPE
Round 1: The problem Have you ever used flask’s built in webserver and thought “this is probably good enough to use for my little thing”? I’ve discovered that it isn’t good for production, and it took a few missteps to find out why. I deployed AutoIDS on a low cost VPS, fired up the .py file, and after a few hours/days, the app would simply hang. If you press ctrl+c in the console window, you’d...
Read more...
-
Dangerous Paste
How many times have we been working hard on an issue, searching forums, blogposts, stack overflow, etc, and come across a proposed solution that says “just paste this into your terminal”? In the heat of the moment it is easy to forget that this situation deserves caution. The problem is that it is easy to sneak extra commands into those cut/copy/pastes thusly: example 1: git clone /dev/null; clear; echo -n "Hello ";whoami|tr -d '\n';echo -e...
Read more...
-
Introducing AutoIDS
Have you ever been on the road or mobile, and you don’t have a snort/suricata test environment set up? AutoIDS is a new(ish) research tool running many versions of Suricata and Snort in a web app. You can use it to: check for malicious traffic develop sigs test basic sig performance test pcap for malicious traffic check for INFO level events in traffic Using AutoIDS To use it simply visit the front page and click...
Read more...
subscribe via RSS