https://isc.sans.edu/diary/rss/27716
Despite Microsoft's attempts to make its Office suite more secure and disable many automatic features, despite the fact that users are warned that suspicious documents should not be opened, malicious Word documents remain a key infection vector today. One of our readers (thanks Joel!) shared a sample that he ( Read more... )

https://isc.sans.edu/diary/rss/27710
I was alerted to a web page masquerading as a local financial institution earlier in the day. The phishing web page was constructed well, looked extremely similar to the financial institution’s actual page and had input fields for victims to input their credentials. Fortunately, it was taken down quickly. However ( Read more... )

https://isc.sans.edu/diary/rss/27708

https://isc.sans.edu/diary/rss/27704
0 - Usability

https://isc.sans.edu/diary/rss/27706
I hope this doesn't work... no comment otherwise.

https://isc.sans.edu/diary/rss/27702

https://isc.sans.edu/diary/rss/27700
I often use Windows BAT files, simple ones, to execute a series of commands. And over the years, I learned not to change these BAT files while they were executing, because cmd.exe would "notice" those changes when it has to execute the next command in the BAT file, and read the changed file, leading to undesired

https://isc.sans.edu/diary/rss/27698

https://isc.sans.edu/diary/rss/27696
A new version of procdump, the Sysinternals tool to create process dumps, was released.

https://isc.sans.edu/diary/rss/27694
This week I started seeing more DNS related activity being identified by Threatintel and that got me curious. While reviewing my logs, I noticed that Wednesday and Thursday had an unusual spike for many inbound unsolicited DNS queries for the domain census.gov.