Hello, welcome to the Tuesday, January 19th, 2021 edition of the Sandcent Storm Center's Stormcast. My name is Johannes Ulrich, and I'm recording from Jacksonville, Florida.

And again, we got a great reverse engineering diary by the DA. This time he walks us through the analysis of a Word

document that then actually leads to an RTF document and finally triggers a download for

an executable. The nice thing about this diary is he really walks you through the different

steps that he undertakes in analyzing this malware.

Also, some of the dead ends basically commands that didn't lead to any results.

So you get a little bit of more systematic view of how to analyze these documents and hopefully

something that you're able to reproduce with documents that you may come across.

And Rob Vandenpring, one of our Internet Storm Center handlers, finished his Center for Internet Security, Cisco NXOS benchmark. If you're not familiar with the Center for Internet Security, Cisco NXOS benchmark.

If you're not familiar with the Center for Internet Security,

they literally publish dozens of benchmarks that you can download from their sites.

These benchmarks, well, they're typically PDFs that basically tell you everything

that you could possibly configure more securely from operating systems to software, like, for example, Apache, including cloud providers, and yes, now also for Cisco NXOS.

One neat thing I like about these benchmarks is that every single step you typically do have a small snippet of the command line and how to implement the particular benchmark.

They're often also either from the center of internet security or third parties, tools like scripts and such that will help you perform these tasks,

or audit the task.

Just keep in mind that like any of these benchmarks, it's essentially a list of everything

that you may secure or configure more securely doesn't mean it's necessarily appropriate

in your environment.

So what you typically end up doing is select a subset of the controls and apply them to your systems.

And while I don't see this particular benchmark listed on the Center for Internet Security

website yet, if you just sign up to receive any of the benchmarks, you'll actually get

...