Hello and welcome to the Monday, January 13th, 2025 edition of the Sands Internet Storm Center's Stormcast.

My name is Johannes Ulrich and today I'm recording from Jacksonville, Florida.

Well, let's start with some Internet Storm Center diaries.

We got a great one from Tom here. Actually, follow up to a story that broke over the holidays and I covered last week about Grome extensions, in particular the Cyberhaven extension and compromise that caused quite a bit of concerns.

Tom is writing about how to detect what extensions are installed via the Defender Console.

So you have to go to Waterbilly Management Inventory's browser extension,

and that's where you have the data that you need to identify what extensions are installed. You get the Chrome extension ID,

so you can search, for example, for malicious extension ideas. This is, of course, critical,

given all the problems that malicious Chrome extensions have caused and the difficulty in sometimes

restricting Chrome extensions as users legitimately like to install them. And Windows Defender,

of course, is a tool that you typically already have available. And we have a second diary,

this one from DDA. And, well, if it's DDA, it has to include some cool features in Office

documents and some Python scripts to analyze them.

In this case, it's OLE documents being embedded in OOXML documents.

Office Open XML, that's the current standard that you find in Windows Office documents. Office Openxml, that's the current standard that you find in Windows Office documents.

Well, OLE is the older standard, but with OXML being so flexible, it's actually able to embed

OLE documents, and with that make it more difficult to detect malicious content in particular

macros. Now, DDA of course here comes to your aid and helps you with some of his tools like

zipdump. PUI and OLE dump.p.uI to assist you in analyzing these documents and identify anything malicious like

macros. And we have updates about last week's vulnerability in Ivanti's Connect Secure product

from Watchtower. And of course, whenever our watchtower is involved, we usually get sort of a deep dive

into how exploitation works against these vulnerabilities. Again, these were already being

...