The art of responding to incidents in an organized and thoughtful manner.

learn more… | top users | synonyms (2)

6
votes
1answer
345 views

How do I identify which PC made a suspicious DNS query?

Our IDS detected a suspicious DNS packet going to a Botnet (or similar). Since that DC is a recursive relay, how can we identify the client who made that request. (Windows DNS server)
5
votes
1answer
353 views

PGP-encrypted Email or SSL/TLS Webform for Responsible Disclosure Communication?

So it's a fairly simple question. When offering an avenue to security researchers for communication with us regarding disclosure of security vulnerabilities, what's the best way to do so? Assume we ...
3
votes
0answers
112 views

attack on Unix procmail analysis

2 days ago I received the following E-mail (this is its original format not the one of any mailer, but where sensitive information is replaced by ••field_name••): From qqqqqq@freemail.net Thu Jul ...
0
votes
0answers
47 views

SSH attempt blocked now ECDSA keys changed

Last night I had an external IP tried to access my server over SSH. The attempt was blocked as it failed to authorise in the number of times and time limit that I'd specified. Doing a whois on the ip ...
-1
votes
0answers
4 views

How to detect a spam attack by using snort

I need to identify if there are spam mails circulating inside a network. Need to know how to write rules for snort to generate an alert