While I was analyzing a standard phishing e-mail my attention was drawn to the fact that the phishing page loaded remote Coldfusion scripts. The phishing mail itself is pretty default. It claims to come from e-mail support telling you that your mailbox is full.

The included cfform component allows to build a form with CFML custom control tags providing more functionality than standard HTML form input elements.

The phishing site was located … Read more.

I published an article on Don’t Dwell On It: How to Detect a Breach on Your Network More Efficiently on the Security Intelligence blog.

This article describes which typical event types you should look for to detect an intrusion. The article lists 5 key steps to react when you suspect an incident is ongoing.

I published an article on What Metrics Do You Need to Measure the Success of Your SOC? on the Security Intelligence blog.

This article describes how you can evaluate the SOC performance and growth more accurately by building out consistent measurements to review it’s essential functions.

The article covers people, roles, technology, policies and processes and also includes some tips for further tuning reporting and metrics to measure the success of your SOC.

I published an article on How to Leverage Log Services to Analyze C&C Traffic on the Security Intelligence blog.

This article describes what can cause C2 traffic, the different types of C2 traffic and what log sources that you can use to detect the C2 traffic caused by malware.