Cybersecurity articles tagged #SANS ISC on RuntimeRebel.https://runtimerebel.comhttps://runtimerebel.com/blog/dshield-siem-update-elk-stack-8-19-15-and-enhanced-logginghttps://runtimerebel.com/blog/dshield-siem-update-elk-stack-8-19-15-and-enhanced-loggingSANS ISC updates the DShield SIEM to ELK stack 8.19.15, introducing enhanced logging capabilities and new dashboards for improved honeypot data analysis.Wed, 15 Jul 2026 10:11:13 GMTDShieldSIEMELK StackSANS ISCHoneypotLog Analysishttps://runtimerebel.com/blog/msi-malware-detection-statistical-analysis-for-base64-payloadshttps://runtimerebel.com/blog/msi-malware-detection-statistical-analysis-for-base64-payloadsLearn how to use statistical analysis to identify obfuscated Base64 payloads within malicious MSI files and improve your incident response capabilities.Mon, 15 Jun 2026 10:19:14 GMTMSI MalwareBase64 ObfuscationThreat DetectionMalware AnalysisSANS ISChttps://runtimerebel.com/blog/detecting-api-discovery-scans-for-swagger-json-security-guidehttps://runtimerebel.com/blog/detecting-api-discovery-scans-for-swagger-json-security-guideAnalysis of automated scans for swagger.json and OpenAPI files. Learn how to secure RESTful APIs against discovery-based attacks and reconnaissance.Wed, 03 Jun 2026 13:51:10 GMTAPI SecurityReconnaissanceSwaggerOpenAPISANS ISChttps://runtimerebel.com/blog/yara-x-1-17-0-release-enhanced-performance-for-malware-analysishttps://runtimerebel.com/blog/yara-x-1-17-0-release-enhanced-performance-for-malware-analysisYARA-X version 1.17.0 release introduces five performance improvements and a bugfix for the Rust-based malware detection engine. Enhance your scanning speed.Sun, 31 May 2026 16:31:57 GMTYARA XMalware DetectionRustThreat HuntingSANS ISChttps://runtimerebel.com/blog/dshield-honeypot-updates-ensuring-timely-threat-data-collectionhttps://runtimerebel.com/blog/dshield-honeypot-updates-ensuring-timely-threat-data-collectionSANS ISC announces upcoming updates for DShield honeypots. Learn why these automatic updates are crucial for maintaining effective threat intelligence collection.Mon, 04 May 2026 16:47:53 GMTDShieldHoneypotSANS ISCThreat IntelligenceSecurity Updateshttps://runtimerebel.com/blog/ipv6-security-mitigating-rogue-router-advertisements-and-ndp-riskshttps://runtimerebel.com/blog/ipv6-security-mitigating-rogue-router-advertisements-and-ndp-risksAnalysis of IPv6 Neighbor Discovery Protocol vulnerabilities and why security teams must prioritize RA Guard and monitoring to prevent traffic interception.Tue, 14 Apr 2026 08:41:10 GMTIPv6NdpNetwork SecuritySANS ISCRouter Advertisementhttps://runtimerebel.com/blog/honeypot-data-analysis-predictable-year-and-season-password-patternshttps://runtimerebel.com/blog/honeypot-data-analysis-predictable-year-and-season-password-patternsSANS ISC research reveals how attackers exploit predictable password patterns, such as years and seasons, driven by outdated rotation policies.Thu, 09 Apr 2026 08:43:49 GMTPassword SecurityHoneypot AnalysisCredential StuffingSANS ISCAuthenticationhttps://runtimerebel.com/blog/ai-assisted-code-review-uncovering-common-python-flawshttps://runtimerebel.com/blog/ai-assisted-code-review-uncovering-common-python-flawsA SANS ISC diary highlights how AI identifies long-standing, common security and logic errors in Python scripts, emphasizing the need for robust code review.Tue, 24 Mar 2026 00:33:52 GMTAI Code ReviewPython SecuritySecure DevelopmentCode QualitySANS ISChttps://runtimerebel.com/blog/phishing-credential-exfiltration-via-emailjs-and-react-frameworkshttps://runtimerebel.com/blog/phishing-credential-exfiltration-via-emailjs-and-react-frameworksSecurity analysis of a sophisticated React-based phishing kit that leverages the EmailJS service for stealthy exfiltration of user credentials.Fri, 13 Mar 2026 08:18:34 GMTPhishingEmailJSReactCredential TheftSANS ISChttps://runtimerebel.com/blog/phishing-campaign-leverages-donut-loader-via-spoofed-fedex-alertshttps://runtimerebel.com/blog/phishing-campaign-leverages-donut-loader-via-spoofed-fedex-alertsAnalysis of a phishing campaign using fake FedEx delivery notifications to deliver the Donut loader framework for in-memory shellcode execution.Fri, 27 Feb 2026 16:17:45 GMTDonutLoaderFedEx PhishingShellcode InjectionSANS ISCIn Memory Malwarehttps://runtimerebel.com/blog/hypervisor-based-persistence-abusing-virtual-machines-for-stealthhttps://runtimerebel.com/blog/hypervisor-based-persistence-abusing-virtual-machines-for-stealthAnalysis of how threat actors leverage virtualization platforms to host malicious guest OSs, bypassing host-level EDR and maintaining persistent access.Thu, 26 Feb 2026 04:39:45 GMTPersistence MechanismsEDR EvasionVirtualization AbuseThreat HuntingSANS ISC