Jorrit Folmer

Please fill out the information below Release date: 12/19/2019 Vendor: Fox-IT Link: https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/ PDF: https://resources.fox-it.com/rs/170-CAK-271/images/201912_Report_Operation_Wocao.pdf Group: APT20 Other:

Unexpected 64kB stdout limitation of ShellOperation.run()

3

# Expectation It seems that stdout from ShellOperation.run() is somehow limited to 64kB. I haven't been able to find the source of this limitation. Is there some way to influence...

Current status of support for Cisco High-Speed Logging (HSL)

12

I've created a new "cisco-hsl" branch to add support for Cisco HSL. However, I'm running into a structural issue: * In template 284 both l4_src_port and l4_dest_port occur twice. This...

Current status of IPFIX RFC compliance

1

Version 3.5.1: | RFC | Level | |-----------|----------------------------------------------| | RFC 7011 | 47% of RFC "MUST" requirements implemented | | RFC 7011 | 19% of RFC "SHOULD" requirements implemented |...

Current status of Netflow v9 RFC compliance

1

v3.5.1: | RFC | Level | |-----------|----------------------------------------------| | RFC 3954 | 100% of RFC "MUST" requirements implemented | | RFC 3954 | 0% of RFC "SHOULD" requirements implemented | |...

Update Netflow v9 and IPFIX Information Elements list in YAML files

1

We don't currently support all the [Information Elements currently assigned by IANA](https://www.iana.org/assignments/ipfix/ipfix.xhtml). An overview can currently be found in issues #83 and #84 TODO: 1. Update netflow.yaml to include all...

The end

2

Hey @hkelley, I'm slowly moving away from Splunk and don't have much time, the Splunk infrastructure or license anymore to keep this project going in a meaningful way. So my...

Add support for OAuth

36

Because e.g. Gmail is dropping support for user/pass authentication: https://gsuiteupdates.googleblog.com/2019/12/less-secure-apps-oauth-google-username-password-incorrect.html

Attacks on reporting URIs as mentioned in RFC 7489

2

RFC7489 mentions a number of threats against DMARC reporting URI's in chapter 12.2. Below is a short discussion of the current mitigation scope. | Threat | Mitigation | |--------|------------| |...