Intrusion Detection System, a system for detecting and alerting based on behavior.

learn more… | top users | synonyms (2)

0
votes
0answers
31 views

Snort rules fo detecting meterpreter sessions

I am learning configuring snort in my setup consisting of an attacker(linux), a victim(android smartphone) and 1 detection system. So far, i have been able to log all the packets between the attacker ...
0
votes
1answer
13 views

Questions on snort generating too many events and not sending to syslog

New to snort here. I downloaded snort (2.9.6.0 GRE Build 47) on my Ubuntu 14.04, also downloaded emergingthreat rules. I ran the following command root@myhp:~/pkgs/emergeThreats/snortRules# snort -...
0
votes
1answer
78 views

Detecting DNS tunneling

I have been trying to detect/establish DNS tunneling. First of all I logged out of my user account of the captive portal. Findings: $ nslookup <somesite> // works fine $ ping <somesite> /...
1
vote
1answer
24 views

How useful is Protocol Anomaly-based IDS?

Protocols such as IP, TCP, UDP, ICMP, and RPC, according to Juniper networks could potentially be useful for IDS objectives of determining the direction and test conditions. In a way, protocol anomaly-...
0
votes
0answers
15 views

VM Introspection on Public IaaS clouds

I came across this Security SE post and a few papers on VM Introspection [1] [2] [3] What prevents cloud providers like AWS from using techniques like these to observe EC2 instance activity? If they ...
1
vote
1answer
37 views

Scan detection Tool better than Snort Portscan Preprocessor

I am working on detection of Scanning activities of Bots/Worms. I have found that Snort Portscan Preprocessor detects Scan activities. I have tweaked Snort Portscan Preprocessor to detect different ...
-1
votes
2answers
68 views

Limit possible harm of ransomware on a fileserver

First to say: I know I need a backup and I have one of course but my question isn't about the safety of the data but about how to reduce the possible time that is needed to restore data. I'm already ...
3
votes
2answers
280 views

Detecting when a screenshot is taken by a software (spyware) in Windows [closed]

Most trojaning, spyware and keylogger tools have the ability to take screenshots. Is there a way to detect if an app or software is taking a screenshot in Windows? Maybe a Windows API call or dll? ...
0
votes
0answers
35 views

Process of auditd -s enable/disable persists for a long time

I have setup auditd on my system, with some basic rules from CIS Benchmark paper and the following auditd.conf file: log_file = /var/log/audit/audit.log log_format = RAW log_group = root ...
7
votes
2answers
119 views

Detecting Process Hollowing

I was brainstorming methods of detecting process hollowing and other forms of code injection, and this one seemed pretty robust. Would it be possible for a "process hollowing scanner" to enumerate ...
2
votes
1answer
148 views

Raspberry Pi IDS/FireWall - Should I? [closed]

I was excited to setup an IDS/FireWall with my new Raspberry Pi on a standard home network. Reading threats to SSH and Linux, now I am not so sure. Setup by an experienced amateur I'm now concerned ...
2
votes
2answers
232 views

How can the nmap tool be used to evade a firewall/IDS?

Some techniques are used to secure the operating system against network attacks e.g.: firewalls, antivirus software, an IDS like SNORT, etc. To take advantage of the nmap tool, is it possible to ...
1
vote
2answers
53 views

What are the technical implementation differences between signature-based scanning and heuristic-based scanning?

Signature-based scanning works by comparing something to a database. So does this basically amount to scanning a file x for string foobar? I know heuristic-based scanning can detect new threats that ...
1
vote
2answers
32 views

Snort Unable to detect portscans in LAN

Setup Information I am doing experiment on portscan detection using snort 2.9.8.I have 10 systems in my lab with id:1,2,3,...,10. i have installed snort in my lab-pc with id:1.Now i am using Pc with ...
2
votes
1answer
83 views

Tap-mode IPS vs IDS

It is my understanding that tap mode IPS, unlike in-line mode, is passive and cannot prevent attacks. In that case, what is the difference between an IDS and a tap mode IPS? I've checked out several ...
1
vote
0answers
54 views

Inconsistent duplicate TCP packets

How often does it happen that we benignly see a TCP packet that is retransmitted but has a different payload the second time? In other words, how often is it that we see a TCP packet with sequence ...
2
votes
0answers
69 views

Snort Portscan Preprocessor Analysis

Remarks I really apologize if this content isn't matching the community, but I am not getting approved on snort-mailing lists and I don't know what can I do for the same, therefore I feel this can be ...
0
votes
3answers
130 views

How does a hack leave no trace in server logs when there is a WORM IDS?

I am wondering if a hacker managed to either SQL inject or social engineer into a database, how does one not leave a trace in the IDS (Intrusion detection like OSSEC)? If an IDS is monitoring the ...
1
vote
0answers
69 views

Network configuration for Security Onion on VMWare ESX

I'm setting up an IDS using Security Onion on VMWare ESX. I have a VLAN from the (physical) switch which has the network SPAN port; this is feeding into the ESX virtual switch, and this port group is ...
0
votes
1answer
97 views

Understand how dionaea honeypot emulated services work

I'm trying to understand Dionaea honeypot and the information flow. I understand that it emulates some services, like SMB, ftp, tftp, try to responde with these, then gets the shellcode and ...
4
votes
1answer
69 views

Basic question about how an IDS works

Would the location of an Intrusion Detection (or Packet Analysis) sensor on an internal network impact whether the external host's Source IP (assuming inbound TCP traffic) is retrievable from a packet?...
1
vote
0answers
35 views

Is there an easier way to test suricata has enough resources to run without losing packets?

I'd like to see the effect of changing my Suricata hardware and software, and in particular make sure I can determine the rate above which I'll start to lose data. I'm running ESXi with 20 cores and ...
19
votes
4answers
2k views

Detect non HTTP packets using port 80

We are currently doing port whitelisting on our firewalls which is working well but this of course does not prevent the implementation of side channels or the misuse of these ports for other purposes. ...
2
votes
1answer
88 views

Linux (!) Network Architecture for CTF-scenario [closed]

My boss recently enrolled me in an InfoSec training. I am part of the network team, but have limited experience in InfoSec. My first assignment is to draw a layout of a network that will be used ...
0
votes
2answers
113 views

Distinction of DPI and IDS

I'm currently reading about Intrusion Detection Systems (IDS) and noticed a huge variety of definitions for the term of Deep Packet Inspection. Especially the NIST shows three different techniques in ...
0
votes
1answer
215 views

(spp_sdf) SDF Combination Alerts in Snort

I'm testing Snort in IDS mode and have been receiving a few (spp_sdf) SDF Combination Alerts as below. Seems like it happens when I visit certain but not all https sites. Tried to google this alert ...
1
vote
1answer
97 views

Are snort rules applied per packet or per flow

I would like to understand if snort rules are applied for each packet in a flow between a source and destination separately? For instance, when packet 1 of the flow arrives at the IDS, all the rules ...
0
votes
1answer
90 views

snort rule to detect relay attempt not working

I am trying to detect a relay attempt on smtp server, but nothing gets logs when I test it out. The snort rule to detect a relay attempt which I tried using is: alert tcp $SMTP_SERVERS 25 -> ...
0
votes
0answers
28 views

Snort matching against single packets

For a specific task, I'd like to match snort rules against the first 1-2 packets of each flow in the network without waiting for the other subsequent flow packets. Can I do this with snort? If so, how?...
0
votes
1answer
89 views

Do I need ossec for my personal home computer? [closed]

Do I really need a HIDS like ossec, or will using good passwords, using a firewall, an antivirus/antimalware program, and a rootkit scanner do the job well enough?
0
votes
0answers
175 views

Suricata IPS manual blocking/unblocking vs. snort and guardian

Does anyone have experience with using Suricata as an IPS? Im on Debian and I'd like to be able to manually block and unblock specific ip addresses (iptables). I've not used Suricata as I am currently ...
-1
votes
1answer
206 views

Which method is the best for IDS : heuristic or signature based? [closed]

In signature based IDS: it maintains a database of the signatures that might signal a particular type of the attack. Problems: New attack that has been specifically constructed in order to not ...
0
votes
0answers
19 views

Current Decryption Support for TLS [duplicate]

I've been locking things at clients down recently and ran into a side effect I hadn't really thought about were TLS traffic using DHE based ciphers can't be decrypted with SSLDump or Wireshark. I ...
4
votes
2answers
644 views

What is the difference between a HIDS/HIPS and an anti virus?

I have gone through what IDS/IPS's are. I understand the difference between a NIDS/NIPS and a HIDS/HIPS. But Host IDS and Host IPS sound like an antivirus software to me, is there a difference?
5
votes
1answer
361 views

Is it possible to detect DPI (Deep Packet Inspection)?

If one suspects one's packets are subject to DPI, how can it be detected?
5
votes
1answer
106 views

Using a single number instead of an IP address or a DNS name, which are concrete uses? [closed]

My question: I have read that using the single number equivalent (called the "binary equivalent" by the author) of the IP address instead of the actual IP address or the domain name can be used "to ...
1
vote
0answers
41 views

What kinds of features are useful for network security visualization? [closed]

I just want to know is network security visualization are practical for enterprise network administrators? (Which I am not) And if it is what kind of tools they uses and what kind of features they are ...
1
vote
2answers
125 views

How eavesdropping attack takes place in network

I am learning some concepts of network security and I have the following question: One case of eavesdropping attack is that an adversary somehow places himself inside a network to order to capture ...
3
votes
1answer
97 views

Detecting botnets that use HTTP instead of IRC

I know most bots use either IRC or HTTP to communicate with the C&C, and http unlike IRC can't be blocked. So if a botnet is using HTTP, how can this be prevented? Just theoretical!
3
votes
1answer
77 views

How to make Snort not log sensitive data from the sniffed traffic?

I have Snort in my network which I use for IDS and it is residing on a VM that receives all mirrored traffic from the switch. I am having a web applications that users use and they login, operate on ...
0
votes
0answers
127 views

Snort arpspoof preprocessor not giving alerts

I'm attempting to use Snort to detect a simple arpspoof attack on a test network I've set up. I have the following 4 ip addresses on this network. 192.168.1.1 Router 00:18:39:EC:F5:78 192.168.1.2 ...
1
vote
1answer
273 views

Suricata rule to block particular website question

I am writing rule for suricata which is going to block the possibility to enter one of the website for example xyz.com (instead of facebook, because with facebook there are some problems). I am doing ...
2
votes
3answers
108 views

Multiple SSL Inspection

I want to ask you if you think that doing SSL Inspection in proxy mode (Resign) could be a problem. The scenario is the following: 1 --> 2 --> 3 Client web browsing IPS device with SSL ...
0
votes
0answers
76 views

Snort rule to detect More Fragments fragbit not working

I have a Virtualbox setup with Snort running on a Windows 7 host and Kali Linux as the attacking machine, connected on an internal network. I'm investigating ways to get Snort to detect fragmentation ...
0
votes
0answers
86 views

Is EasyIDS obsolete?

I have found EasyIDS from Skynet Development recently but noticed that the latest change-log is from 2009. Does this mean it is obsolete and should not be used as it is not being kept up-to date?
0
votes
0answers
121 views

Switching from Snort rules to Emerging Threats. Is there a way to know which ET rule sid covers the same vulnerabilty as Snort rule sid?

Our company has been using the snort community rules and we have tuned our rule files over years to our specific needs. Now our company has decided to use Emerging Threats (ET) open rules. The ET ...
0
votes
1answer
103 views

fwsnort - How safe compared with Snort/Suricata?

How safe is 'fwsnort' compared to a real Snort / Suricata instance? What's the percentage of VRT / ET Rules, that fwsnort can actually use? I read somewhere from an older article its only ~ 60% - is ...
6
votes
1answer
827 views

How do I identify which PC made a suspicious DNS query?

Our IDS detected a suspicious DNS packet going to a Botnet (or similar). Since that DC is a recursive relay, how can we identify the client who made that request. (Windows DNS server)
1
vote
0answers
11 views

Adding Windows 7 VM as a log source/forcing the IDS inline

I'm investigating ways to add my Windows 7 VM as a log source or even run that traffic through my IDS VM and then out to the internet but I'm not entirely sure how to approach it. Does anybody have ...
1
vote
1answer
18 views

IDS device behaviour

Which of the following is a reasonable response from the ids when its detects ip packets where ip source address and port is the same as the destination IP address and port A. Allow the packet to be ...