SANS Internet Storm Center (ISC) provides a daily “diary” of notable security events, emerging threats, and exploit/activity observations. The feed is geared toward practitioners, often including quick technical notes, indicators, and practical defensive takeaways.
A new onedump.py option outputs embedded files from multiple OneNote files as JSON. Piping the output to myjson-filter.py writes the files to disk using each file's SHA-256 hash as its name.
A SANS diary described a newly observed ClickFix campaign using a fake Cloudflare verification page on macOS and Windows. The malware could not be retrieved: one server returned 403, and another domain did not resolve.
A tutorial for deploying Ghidra Server in a malware-analysis lab to preserve and share reverse-engineering projects, with setup and access-control guidance and a warning to keep the server isolated because repositories contain sample bytes.
A SANS diary demonstrates using Kibana field distributions and HTTP charset/language headers to narrow DShield honeypot logs, identify anomalous requests, and surface repeated endpoint scans from hosts in AS-7456.
YARA-X 1.22.0 includes 11 improvements and 9 bug fixes, including built-in functions for reading 64-bit integers.
A log-based reconstruction of an Akira-attributed intrusion traced SSLVPN brute force, Kerberoasting, RDP movement and pre-encryption actions. Joining firewall and Windows logs exposed the sequence and informed practical detection and retention guidance.
