Intrusion Detection Systems

learn more… | top users | synonyms (2)

0
votes
0answers
25 views

Possible to run snort without modifiers?

Is there anyway (e.g some command line argument) with which we can tell snort to run and perform detection but without caring for the rule modifiers if there are any ? e.g alert tcp any any -> ...
-1
votes
1answer
29 views

Recommendations for installing OSSIM

I'm an apprentice in web security and I was assigned with the task of researching about OSSIM. Bear with my infinite ignorance as I take my questions to the stack exchange gurus. What I know so far: ...
1
vote
2answers
74 views

List of security products for my network [closed]

We are building and environment where mostly open source and trial versions would be used first before we purchase any product. I need your recommendation on the tools required to build a network that ...
0
votes
0answers
30 views

OSSEC not detecting deleted files?

I have configured 3 VMs: ossec server and two agents in CentOS 6 and Windows 2k8 R2. I have completed the setup and FIM and Log Management works smoothly. It also reports the new files. However, it ...
-1
votes
2answers
88 views

What are the difference between IPS and WAF in terms of DDoS?

I have heard about both Web Application Firewalls (WAF) and Intrusion Prevention Systems (IPS). Which is better in preventing a Distributed Denial of Service (DDoS) attack and why?
1
vote
0answers
17 views

I want to filter Snort rules by date written

I would like the ability to look at Snort rules that were written in specific date ranges only given a collection of .rules files from either Sourcefire or Emerging Threats. Is this possible?
1
vote
2answers
89 views

IDS across seperate AWS accounts

I have 2 separate AWS accounts and I would like to a Vuln scanner/IDS on one to scan another. One environment is a regular AWS account and the other is in AWS Gov Cloud. Due to limitations within ...
1
vote
1answer
89 views

How to detect/mitigate UDP port scan using OpenBSD and pf

One of our OpenBSD firewalls experienced a flood of UDP traffic from a compromised host within our internal network. The traffic was exchanged between the compromised internal host and a single ...
0
votes
3answers
195 views

Why do we need IDS/IPS if a firewall is present?

Why do we need IDS/IPS if a firewall is present?
0
votes
1answer
54 views

Why does IBM's Intrusion Detection System Show Local IPs instead of Public IPs for the Source of an Attack?

Security Intern here given the assignment to find the IP address of an attacker using IBM's IDS. The event or attack in question is entitled X509_Weak_Signature_Algorithm, and from what I ...
0
votes
1answer
69 views

Snort Rule Comparison

As far as I read, Emerging threats and VRT Snort rules are available freely, and also Pro (fee based). Is there any comparision, or anything to suggest choose one over another? What are the benefits ...
2
votes
1answer
49 views

Anomaly intrusion detection

Anyone know which opensource network IDSs are using anomaly techniques? My project is to compare them, so if you could give me some hints, that would be much appreciated. Currently, I am looking at ...
0
votes
1answer
51 views

HIDS that can detect attacks, take immediate action locally, and then report to a central service for re-broadcasting to other systems?

I've been researching this for a bit now and cannot find what I want. So I'm to the point where I'm weighing my options as to how I can proceed. Background I'd like to setup a HIDS that has the ...
0
votes
1answer
33 views

Can Sagan block active acts once they've been detected?

I'm trying to determine if Sagan can do anything similar to fail2ban where detected attacks can be temporarily blacklisted, via a system's firewall (iptables). Does Sagan have any "countermeasures" or ...
0
votes
0answers
47 views

SSL Certificate and IDS\IPS

I'm currently drafting an infrastructure design to provide web (internet) access to a number of users to an internal web server in our perimeter DMZ, we have no direct internet access but we do have a ...
0
votes
1answer
247 views

High-Risk Intrusion Detected

I have an endpoint protection from Symantec. Recently, I have been receiving many Symantec Cloud Alert emails. wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php They ...
2
votes
3answers
818 views

Is there any good reason to choose IDS over IPS?

As far as I know, IDS sniffs network traffic, and if intrusion is detected, reports it. And IPS sniffs network traffic, and if intrusion is detected, rejects it, and reports why it was blocked. Am ...
0
votes
1answer
60 views

Server Security Through Constant Check-ins [closed]

I've built a system and have put a ton of work into making sure is super secure. But I have a (potentially irrational) fear that if someone were able to break into my server, they could just change ...
0
votes
1answer
77 views

How to detect suspicious activity on a web and mailserver?

There is a OpenBSD (64bit; 5.5) server having nginx (HTTP/HTTPS) and SMTP (OpenSMTP). Question: What are the best practices to detect suspicious activity? Are there any scripts that shows ...
3
votes
1answer
77 views

Obfuscate IDS rules

Are there known techniques to obfuscate IDS rules, so they can't be easily used by attackers to reverse-engineer the vulnerability that they detect? Let me provide some context. Sometimes IDS ...
1
vote
3answers
95 views

Is there any hardware solution for IDS?

Are there any products that let you see and set IDS [Intrusion detection system] on router or any another hardware that is connected to the router? All the ones I have found of them are Operating ...
1
vote
1answer
40 views

Scan interpreted code for long lines to detect code injection?

As http://security.stackexchange.com/a/11935/35886 states: the best protection against code injection is to prevent it but often you see posts on SO or here that goes like I found "long line of ...
1
vote
2answers
184 views

Intrusion Detected - OS Attack

I have recently gotten a prompt from my anti virus stating that there was an intrusion with an OS attack as describe in the link below: ...
0
votes
1answer
140 views

How can I test a DoS attack against snort?

I need to set up an scenario where an attacker DoS attacks port 80 of an server while snort and others users try to connect to port 80 at the same time. Something like this: 1000 connections to port ...
1
vote
2answers
118 views

the dangers of internet forums - what is FUD, what is not

I just visited a forum and a member knew what OS I was running without me saying anything (a not TOO common distro of linux). Now I'm not sure how he exactly he might have done it, or what information ...
2
votes
2answers
978 views

How to block network scans with pfsense?

I am using pfsense as firewall, and I would like to know how I can stop network scans from enumerating open services and ports. Thanks
0
votes
2answers
134 views

Securing a Windows PC

Currently I have an "Antivirus" and Anti Malware software installed. In addition I closed all remote assistance and unused port rules on my firewall. I'd really like to get a complete as possible ...
0
votes
1answer
35 views

Is it possible to detect IDS name and version

the title said it. Is it possible to detect IDS name and version. If server use Snort as IDS, would I be able to detect it from external PC? And if it's possible how?
1
vote
2answers
139 views

Web-based intrusion detection integrating visibility into web app and database

Consider the problem of hardening an existing, database-backed web application, to detect attacks and stop them where possible. It seems like one plausible approach might be to build an intrusion ...
3
votes
1answer
491 views

Open source solution to capture and decrypt SSH traffic (with private key)?

I am looking for a free open source solution that is able to capture and decrypt SSH traffic given the fact that I can provide the server's RSA private key (something like SSH CryptoAuditor). Please ...
0
votes
1answer
261 views

Are my Snort rules correct?

I am trying to do a Snort demo and I though it would be nice to detect a real threat. I picked the sasser worm and the jolt/teardrop dos attacks for the demo; no particular reason. Out of the three ...
1
vote
1answer
79 views

Help with successful Internal intrusions

I'm requesting some help with a particular breach of access that we've experienced in our environment. the attacker is an internal employee who has made a few notes about the environment that I ...
0
votes
0answers
138 views

Difference IDS/IPS layer 2 or 3

I understand that an IDS/IPS working on layer 2 has more insight into what is going on. But considering IDS/IPS evasions, why is a layer 2 device preferable as compared to a layer 3 device that is ...
2
votes
4answers
155 views

Intrusion detection architecture

I want to propose an architecture of intrusion detection on the schema shown below. Should I place one IDS in front of each server, or would one be sufficient for all the servers?
0
votes
1answer
114 views

What is a next generation IDS? [closed]

Intrusion detection has been there for many years. It monitors network traffic and/or system events like sys calls or other data and determines whether an event is intrusion or not. But I am curious ...
5
votes
1answer
253 views

How to detect malicious code sending information to attacker's server in linux

Suppose you have some malicious code on your linux laptop, for example a rootkit or trojan or something like that. Now restrict your attention to the case that the malicious code does transfer some ...
0
votes
1answer
370 views

Can a Tor exit node be reliably identified?

So with my knowledge of Tor, I know that exit nodes are where packets escape the Tor network and enter the "traceable" internet; ie. you can link an attack to an exit node but not the source of the ...
1
vote
2answers
211 views

How to detect Snort on the network?

Does anyone know how to fingerprint an IPS ? is there any tool available to do the job? I want to detect snort in my network . Would appreciate any kind of help.
0
votes
2answers
51 views

Attack Signatures books [closed]

I have an assignment to do for school which involves attack signatures (I have to do a service-specific IDS). Basically what I have to do is to generate signatures for some attacks with Metasploit on ...
0
votes
3answers
112 views

IDS in combination with vulnerability scanner

I'm planning to set up a server environment with high security requirements on which i want to install an intrusion detection system (snort). Additionally, I think of running a vulnerability scanner ...
2
votes
2answers
82 views

server with eth0 promisc-mode vulnerable to attacks outside firewall?

If you use a passive network tap and a server with an Ethernet port in promiscuous mode to monitor all traffic between WAN port of your router and RJ45 port of your ISP cable modem. Is the IDS ...
2
votes
3answers
219 views

EICAR alternative for IDS/IPS

Is there a way to trigger alarms in an Intrusion Detection System with something similar to the EICAR test virus? Maybe some special packet that is harmless to the environement, but will trigger IDS? ...
6
votes
1answer
267 views

Isn't a HIDS, NIDS and WAF complementary?

Assume this scenario: Someone trying to hack a website. Simply put: www.site.com/example.php?=<script>alert(1)</script> A HIDS would see this attempt in Apache's access log, a NIDS would ...
2
votes
1answer
376 views

How to configure Suricata to not interfere with virtual machine

I'm currently planning on setting up Suricata as a firewall on my laptop. I'm wondering however if it's possible to set Suricata to not interfere with traffic to and from specific virtual machines ...
2
votes
1answer
326 views

IPS/IDS and Firewall Solution(s) to a Small Office

I was tasked with implementing a network security solution for a small real estate agency. They are a typical old-school mom and pops shop, about 15 employees with basic file sharing, printing, and ...
2
votes
1answer
321 views

Locate rogue wireless access point using Kismet data

Is there any way how to use Kismet data to locate rogue wireless access points?
2
votes
1answer
264 views

Snort Rule Writing (Alert Fires But Traffic Does Not Match *Intended* Rule)

I have the following rule: alert tcp $HOME_NET any > $EXTERNAL_NET any (msg:"This should not happen"; flow:established,to_server; content:"GET "; depth:4; content:"Set-Cookie:"; http_header; ...
1
vote
3answers
2k views

NGINX Hacking Attempt

Every time I start my test-server and let it run for some days I get this in my log-files (in different variations): 111.241.26.165 - - [18/Feb/2014:22:16:45 +0100] "\x04\x01\x00\x19\xCBER!\x00" 400 ...
4
votes
1answer
812 views

New to ossec - what does active response do out of the box

I am new to ossec. I installed the server and wui on a dedicated machine. I have agents running on my zookeeper and kafka servers to start. Below are events I am seeing. I assume the are ...
4
votes
3answers
470 views

Log Attacks in Different Files using Snort

How can I log attacks separately using snort. I basically want to log attacks invoked from different files separately. Like if I have 2 files, ddos.rules and log.rules, then I want logs generated from ...