New answers tagged ids
There are two ways on how to run an IDS: to detect attack attempts to detect successful attacks The mode is defined by the rules which are enabled. In most environments, like yours, there is no clear strategy which leads to having both kinds of events triggered. If you want to detect possibly successful attacks only (and ignoring attempts which are not ...
Answer No, this is not an indication for a compromise. Details about Portscans As the messages indicate, there are two different kinds of portscans happening: TCP Scan: Either a full (SYN, SYN/ACK, ACK) or half-open (SYN, SYN/ACK) scan FIN Scan: A more advanced scan technique It depends which threshold is required by the FW/IDS module to generate ...
Try looking into Scanlogd http://www.openwall.com/scanlogd/ Also look into psad (Port Scan Attack detector) http://cipherdyne.org/psad/ I havent tried using either of them. Though I am not sure how much better than Snort these will be, I am sure these allow for much higher degree of customization, which may help.
Many file-encrypting ransomware viruses add some "unique" file extension to the name of the affected file and leave a "manual" of how to decrypt the files in the affected directories. This is one of the easiest ways to detect them. On windows file servers you can set up the file server ressource manager to look for those files and block the creation or ...
The best way that I would recommend would be to use a storage solution that offers block level storage vs file-system level storage. Many SAN solutions, and shinier cluster-based storage solutions like gluster and ceph, offer periodic snapshots of the storage blocks. Got ransomware? Roll back to your most current snapshot. Poof, no harm done. (After you ...
My answer would require writing some code. I'm only posting this answer because you mentioned a programming related solution in your question. Ever since Window Vista, the windows kernel raises an event for basically every single thing that happens on your computer. Microsoft provides a library called TraceEvent for .NET that makes it absolutely trivial to ...
You can detect it by monitoring free space (very easy) or file writes (not that easy). The screenshots must be stored somewhere so files will have to stack up to a not-so-obvious location. This is the method I used, and I managed to locate and eliminate a multi-logger just by using a simple file manager.
To detect processing hollowing , you can use compare PE header disk vs memory since it will be executed on a normal thread http://www.adlice.com/runpe-hide-code-behind-legit-process/ To detect dll injection you can do a vad walking, or stack tracing: Look for article called : "Walking the VAD Tree" & "Scanning Process Memory for Injected Code"
Top 50 recent answers are included