InfoCON: green

A few months ago, I wrote a diary about online services used to exfiltrate data[1].

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. from SANS

If many malware samples try to be "filess" (read: they try to reduce their filesystem footprint

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. from SANS

The volume of honeypot logs changes over time. Very rarely are honeypot logs quiet, meaning

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. from SANS

We have had a "newly registered domain" feed for a few years. This feed pulls