Dshield

Podcast
DShield is a community-based collaborative firewall log correlation system.[2] It receives logs from volunteers worldwide and uses them to analyze attack trends. It is used as the data collection engine behind the SANS Internet Storm Center (ISC). DShield was officially launched end of November 2000 by Johannes Ullrich. Since then, it has grown to be a dominating attack correlation engine with worldwide coverage. DShield is regularly used by the media to cover current events. Analysis provided by DShield has been used in the early detection of several worms, like "Ramen", Code Red, "Leaves", "SQL Snake" and more. DShield data is regularly used by researchers to analyze attack patterns. The goal of the DShield project is to allow access to its correlated information to the public at no charge to raise awareness and provide accurate and current snapshots of internet attacks. Several data feeds are provided to users to either include in their own web sites or to use as an aide to analyze events. Source

Actions

Share this page

Media Outlet details

Scope Local
Language English
Country United States of America
Similarweb UVMSimilarweb UVM Request pricing
Comscore UVMComscore UVM Request pricing

Recent Articles

Search

Linux Process Name Masquerading

|
By grep Container
| Dshield
In a previous diary, I talked about stack strings[1] with a practical example of them. Since my SEC670 class, I’m even more interested in malware obfuscation techniques. I had a look at process names. When you list running processes on a computer, can you trust what you see? If you're facing a rootkit, malicious processes can be simply hidden (the API calls or commands to list processed have been tampered). But a malicious process can also mimic a non-suspicious name by masquerading their name.
Open in Who Shared Issue with article?

CVE-2024-40766: The Patch Fixed the Bug. Nobody Fixed the Configuration.

| Dshield
Click HERE to learn more about classes Manuel Humberto is teaching for SANS In August 2024 SonicWall published advisory SNWLID-2024-0015 for CVE-2024-40766. It is an improper access control vulnerability in SonicOS. CVSS 9.3. It affects the management interface and the SSLVPN service on Gen 5, Gen 6 and Gen 7 firewalls.
Open in Who Shared View Duplicates (4) Issue with article?

Webshells Remain Popular

| Dshield
Webshells have been popular for a long time. We already covered this topic across multiple diaries[1][2]. I spent some time to track them[3] and slighly paid less attention to them but today I found another one. It seems to be a new player (pushed on Github two months ago). The webshell is called ZypeerShell[4] and pretend to be "The most powerful, undetectable, and feature-rich PHP webshell available on GitHub.".
Open in Who Shared View Duplicates (2) Issue with article?

eBanking Phishing Delivered Through IPv4-Mapped IPv6 Address

| Dshield
I detected an interesting phishing email this morning. It targets a major Belgian bank: The phishing in itself is a classic one, not relevant but the malicious link is interesting: hxxp://[::ffff:5511:74be]/kWC5PHA1 The technique used by the attacker is to bypass simple security controls trying to extract domain names and IP addresses via simple regular expressions. The notation “[…]” tells the URL parser that what's inside is a literal IPv6 address. But it’s not a real IPv6 address.
Open in Who Shared View Duplicates (4) Issue with article?

The browser blind spot: Why your security tool may not be blocking what you think it is [Guest Diary]

| Dshield
Click HERE to learn more about classes Johannes is teaching for SANS Published: 2026-06-17. Last Updated: 2026-06-17 16:01:33 UTC by Varun Murdula (Version: 1) [This is a guest diary submitted by Varun Murdula] CASB block policies rely on inspecting TCP traffic. QUIC, the protocol powering HTTP/3, runs over UDP, a protocol most CASBs cannot inspect. The result: Chrome can reach a destination your CASB is supposed to block, and nothing in the logs shows it happened.
Open in Who Shared View Duplicates (3) Issue with article?

The Behavior of Coordinated SSH Brute Force Attacks over the last three months [Guest Diary]

| Dshield
[This is a Guest Diary by Adam Nason, an ISC intern as part of the SANS.edu BACS program] Brute force SSH attacks are an ever-present threat on the internet today. We examine probing behavior over the last three months to identify coordinated and opportunistic attacks by threat actors. A DShield Honeypot has quietly collected and logged the behavior of these threat actors to develop a clearer picture of their malicious intentions.
Open in Who Shared View Duplicates (4) Issue with article?

From a VHDX File to a Remcos RAT

|
By Otidiform 'bqmjaryi ClMtexEa"
| Dshield
Yesterday, a reader reported to us a malicious ZIP archive (SHA256: a0104921a2d37ab87482ac9a9f5c3713479c118846c3e999178e75b81620c094[1]). Once unzipped, it contains a VHDX file that discloses a malicious JavaScript after being mounted (which is automatic on modern Windows OSs): Two different techniques to hide the payload help to bypass most first-line security controls. Using a disk image as a "malware container" has been used multiple times in the past[2] but seemed to be less used these days.
Open in Who Shared Issue with article?

Evil MSI Background: BASE64 Statistical Analysis

| Dshield
I like it when a fellow handler posts a diary entry about images with malicious content. Last one is Xavier: "The Evil MSI Background is Back!". I like to have a go at the sample with my tools, and see if there are any improvements I can make to my tools. Let's take a look at the bytes present in this suspicious JPEG file, using my tool byte-stats.py: The results: almost half of the content (45.65%) is BASE64 characters, and the longest BASE64 string is 1000 characters.
Open in Who Shared View Duplicates (4) Issue with article?

How has use of framing protection security headers changed in the past 3 years?

| Dshield
Click HERE to learn more about classes Jan is teaching for SANS Published: 2026-06-10. Last Updated: 2026-06-10 08:29:21 UTC by Jan Kopriva (Version: 1) Back in 2023, I wrote a diary[1] discussing how commonly X-Frame-Options and CSP headers containing the frame-ancestors directive were used on 1 million most popular domains on the internet (based on the Tranco list[2]), and how they were set.
Open in Who Shared View Duplicates (3) Issue with article?

Microsoft June 2026 Patch Tuesday

| Dshield
Click HERE to learn more about classes Johannes is teaching for SANS Published: 2026-06-09. Last Updated: 2026-06-09 17:34:29 UTC by Johannes Ullrich (Version: 1) Microsoft today released patches for 204 vulnerabilities. 38 of these vulnerabilities are considered critical, and three have been disclosed before today. Six of the vulnerabilities affect Microsoft cloud solutions and do not require any user action.
Open in Who Shared View Duplicates (4) Issue with article?