Intrusion Detection Systems

learn more… | top users | synonyms (2)

1
vote
2answers
142 views

Intrusion Detected - OS Attack

I have recently gotten a prompt from my anti virus stating that there was an intrusion with an OS attack as describe in the link below: ...
-3
votes
0answers
47 views

iptables raw table

I'm trying to collect iptables common shield rules, here is my current list: echo "-Check for All flags enabled&Drop." iptables -I INPUT -p tcp --tcp-flags ALL ALL -j DROP echo ...
0
votes
0answers
20 views

How to use the Suricata IDS to monitor the entire network? [migrated]

I have the following 3 PCs connected to a router via Ethernet: PC1 – 192.168.1.101 (Linux Ubuntu) PC2 – 192.168.1.100 (Windows) PC3 – 192.168.1.1 (Windows) All PCs can ping each other. PC1 has ...
0
votes
1answer
44 views

How can I test a DoS attack against snort?

I need to set up an scenario where an attacker DoS attacks port 80 of an server while snort and others users try to connect to port 80 at the same time. Something like this: 1000 connections to port ...
2
votes
2answers
88 views

the dangers of internet forums - what is FUD, what is not

I just visited a forum and a member knew what OS I was running without me saying anything (a not TOO common distro of linux). Now I'm not sure how he exactly he might have done it, or what information ...
1
vote
2answers
71 views

How to block network scans with pfsense?

I am using pfsense as firewall, and I would like to know how I can stop network scans from enumerating open services and ports. Thanks
0
votes
2answers
105 views

Securing a Windows PC

Currently I have an "Antivirus" and Anti Malware software installed. In addition I closed all remote assistance and unused port rules on my firewall. I'd really like to get a complete as possible ...
0
votes
1answer
31 views

Is it possible to detect IDS name and version

the title said it. Is it possible to detect IDS name and version. If server use Snort as IDS, would I be able to detect it from external PC? And if it's possible how?
0
votes
0answers
104 views

Error configuring Snort

I am setting up snort on Windows 8 machine and having trouble with it. I am following the instructions mentioned here: http://www.snort.org/assets/151/Installing_Snort_2.8.6.1_on_Windows_7.pdf On ...
0
votes
1answer
60 views

Web-based intrusion detection integrating visibility into web app and database

Consider the problem of hardening an existing, database-backed web application, to detect attacks and stop them where possible. It seems like one plausible approach might be to build an intrusion ...
3
votes
1answer
218 views

Open source solution to capture and decrypt SSH traffic (with private key)?

I am looking for a free open source solution that is able to capture and decrypt SSH traffic given the fact that I can provide the server's RSA private key (something like SSH CryptoAuditor). Please ...
0
votes
1answer
79 views

Are my Snort rules correct?

I am trying to do a Snort demo and I though it would be nice to detect a real threat. I picked the sasser worm and the jolt/teardrop dos attacks for the demo; no particular reason. Out of the three ...
1
vote
1answer
68 views

Help with successful Internal intrusions

I'm requesting some help with a particular breach of access that we've experienced in our environment. the attacker is an internal employee who has made a few notes about the environment that I ...
0
votes
0answers
62 views

Difference IDS/IPS layer 2 or 3

I understand that an IDS/IPS working on layer 2 has more insight into what is going on. But considering IDS/IPS evasions, why is a layer 2 device preferable as compared to a layer 3 device that is ...
2
votes
4answers
110 views

Intrusion detection architecture

I want to propose an architecture of intrusion detection on the schema shown below. Should I place one IDS in front of each server, or would one be sufficient for all the servers?
0
votes
1answer
77 views

What is a next generation IDS? [closed]

Intrusion detection has been there for many years. It monitors network traffic and/or system events like sys calls or other data and determines whether an event is intrusion or not. But I am curious ...
5
votes
1answer
158 views

How to detect malicious code sending information to attacker's server in linux

Suppose you have some malicious code on your linux laptop, for example a rootkit or trojan or something like that. Now restrict your attention to the case that the malicious code does transfer some ...
0
votes
1answer
76 views

Can a Tor exit node be reliably identified?

So with my knowledge of Tor, I know that exit nodes are where packets escape the Tor network and enter the "traceable" internet; ie. you can link an attack to an exit node but not the source of the ...
1
vote
2answers
130 views

How to detect Snort on the network?

Does anyone know how to fingerprint an IPS ? is there any tool available to do the job? I want to detect snort in my network . Would appreciate any kind of help.
0
votes
2answers
39 views

Attack Signatures books [closed]

I have an assignment to do for school which involves attack signatures (I have to do a service-specific IDS). Basically what I have to do is to generate signatures for some attacks with Metasploit on ...
0
votes
3answers
74 views

IDS in combination with vulnerability scanner

I'm planning to set up a server environment with high security requirements on which i want to install an intrusion detection system (snort). Additionally, I think of running a vulnerability scanner ...
2
votes
2answers
66 views

server with eth0 promisc-mode vulnerable to attacks outside firewall?

If you use a passive network tap and a server with an Ethernet port in promiscuous mode to monitor all traffic between WAN port of your router and RJ45 port of your ISP cable modem. Is the IDS ...
2
votes
3answers
137 views

EICAR alternative for IDS/IPS

Is there a way to trigger alarms in an Intrusion Detection System with something similar to the EICAR test virus? Maybe some special packet that is harmless to the environement, but will trigger IDS? ...
6
votes
1answer
247 views

Isn't a HIDS, NIDS and WAF complementary?

Assume this scenario: Someone trying to hack a website. Simply put: www.site.com/example.php?=<script>alert(1)</script> A HIDS would see this attempt in Apache's access log, a NIDS would ...
2
votes
1answer
197 views

How to configure Suricata to not interfere with virtual machine

I'm currently planning on setting up Suricata as a firewall on my laptop. I'm wondering however if it's possible to set Suricata to not interfere with traffic to and from specific virtual machines ...
2
votes
1answer
174 views

IPS/IDS and Firewall Solution(s) to a Small Office

I was tasked with implementing a network security solution for a small real estate agency. They are a typical old-school mom and pops shop, about 15 employees with basic file sharing, printing, and ...
2
votes
1answer
155 views

Locate rogue wireless access point using Kismet data

Is there any way how to use Kismet data to locate rogue wireless access points?
1
vote
1answer
160 views

Snort Rule Writing (Alert Fires But Traffic Does Not Match *Intended* Rule)

I have the following rule: alert tcp $HOME_NET any > $EXTERNAL_NET any (msg:"This should not happen"; flow:established,to_server; content:"GET "; depth:4; content:"Set-Cookie:"; http_header; ...
1
vote
3answers
770 views

NGINX Hacking Attempt

Every time I start my test-server and let it run for some days I get this in my log-files (in different variations): 111.241.26.165 - - [18/Feb/2014:22:16:45 +0100] "\x04\x01\x00\x19\xCBER!\x00" 400 ...
2
votes
1answer
336 views

New to ossec - what does active response do out of the box

I am new to ossec. I installed the server and wui on a dedicated machine. I have agents running on my zookeeper and kafka servers to start. Below are events I am seeing. I assume the are ...
4
votes
3answers
242 views

Log Attacks in Different Files using Snort

How can I log attacks separately using snort. I basically want to log attacks invoked from different files separately. Like if I have 2 files, ddos.rules and log.rules, then I want logs generated from ...
1
vote
0answers
168 views

Snort not showing dropped/blocked packets

This question is about SNORT- I m basically trying to detect PING FLOOD attack. I have included the rule**(drop icmp any any -> any any (itype:8; threshold, track by_src, count 20, ...
0
votes
1answer
48 views

Industry standards for threat names

One of the security appliances we own reports a so-called "Industry Name" for the threats it detects on the network. I wanted to know if there is really such a standard and where I can find ...
0
votes
1answer
168 views

Cryptic threat names

I have logs from a security appliance from Damballa which has cryptic names for threats observed in a network which I am trying to make sense of. Some examples of these threats are "RedTreeBruisers" , ...
-4
votes
2answers
76 views

Ips used by the same person?

Is it possible to find out if ips are from the same location and used by one person. We have a situation were three ips have been logged etc. We know for sure that two are from the same person this ...
0
votes
1answer
132 views

IDS false positive rates

Are there any industry accepted standards for the false positive rates for a Network IDS based on Snort? Is there a way to check the false positive rates in a deployed IDS? (ideally without looking at ...
0
votes
1answer
77 views

Intrusion Detection and Prevention technologies [closed]

I'm supposed to do a research paper on a recent technology and I thought of doing it on a technology in information security. I found interest on Intrusion detection and prevention systems (IDPS) but ...
7
votes
2answers
226 views

What criteria should be used for manually reviewing / prioritizing failed logins?

I have a web application that is exposed to the Internet, and am interested in creating alerts, or prioritizing the manual review of failed logins to the web application. What thresholds, or ...
3
votes
1answer
96 views

Tracking down the source of email attacks

For the past week our company's IDS has been blocking 100-200 meeting invite emails per day from a specific client that are loaded with buffer overflows targeted at Exchange 2003. The payloads are ...
2
votes
1answer
47 views

Do generic custom scripts avoid detection more than common security applications?

Are scripts coded only using the default API of a high level, interpreted language for generic and meticulous gathering of network device & host software information that are already available ...
3
votes
7answers
327 views

How does an IDS identify a computer ?

How does an IDS identify a computer on the network. I mean do IDS' actually check whether a device is actually what it claims to be ? If so what factors does it check (MAC etc) ? For e.g. if a ...
0
votes
2answers
205 views

Questions on IDS, IPS, VLANs and VPN [closed]

I have a network that has a single point of entry the WAN. The WAN exposes about 10 static IP's that resolve internally to servers that are in the same subnet. Meaning that if you RDP over 3389 to ...
1
vote
1answer
109 views

Botnet callback patterns

I am trying to understand the network behavior of bots. Are there any identifiable characteristics of callback requests from the bot to the C&C server which differentiates it from normal traffic? ...
1
vote
1answer
103 views

How to properly configure OSSEC for Web Application Security ?

I would like to implement OSSEC as HIDS on my server, but by default OSSIC monitors a number of folders. I am going to deploy a web application on my server. So what should be my default OSSEC ...
6
votes
3answers
8k views

Difference between IDS and IPS and Firewall

The differences between an IDS and a firewall are that the latter prevents malicious traffic, whereas the IDS: Passive IDS: the IDS only reports that there was an intrusion. Active IDS: the IDS also ...
1
vote
1answer
218 views

OSSEC on an existing running machine

I am setting up a OSSEC on existing running machine. From my research I find that I should be running the following command to check for previous intrusion. zcat /var/log/*.gz | ...
1
vote
1answer
51 views

Moving all servers to routeable IP Addresses

Company I am consulting to wants to move all their servers from private IP space to public IP space. I'm am trying to convince them that this is a bad idea that it makes sense to move only certain ...
6
votes
3answers
599 views

How could malware like Stuxnet be detected?

Stuxnet and others in this list of state-of-the-art Internet worms had certain features that they were very stealthy in leaking out the information they harvested. Thus it managed to go under the ...
1
vote
2answers
155 views

Can IPS system be used as IDS and vice versa

I would like to know can an Network Intrusion Prevention System[IPS] be used as an Network Intrusion Detection System[IDS] and vice versa. Can the Host based IPS be used as a host based IDS and vice ...
1
vote
2answers
360 views

Suricata IPS rules for honeypot

I have a really simple high interaction honeypot and I have just installed a VM as an IPS (suricata) with a transparent bridge between my router and the honeypot. The setup looks something like this: ...