ISC - Add Punycode to your Threat Hunting Routine #243
Description
CTI Content
✅ Content successfully downloaded and saved to file.
Content Preview:
Add Punycode to your Threat Hunting Routine
IDNs or “International Domain Names” have been with us for a while now (see RFC3490[1]). They are (ab)used in many attack scenarios because.. it works! Who can immediately spot the difference between:
The magic is to replace classic characters by others that look almost the same. In the example above, the letter “o” has been replaced by Greek character “o”.
If they are very efficient for attackers, they remain below the radar in many organizations. ...
Full content length: 1,539 characters
Saved to: .hearth/intel-drops/issue-243-cti.txt
*The full content has been downloaded and will be processed automatically.*https://isc.sans.edu/diary/Add+Punycode+to+your+Threat+Hunting+Routine/32640/
Link to Original Source
https://isc.sans.edu/diary/Add+Punycode+to+your+Threat+Hunting+Routine/32640/
Your Name / Handle
DarkWizardCatcher
Link to Profile (Optional)
No response