New answers tagged

1

I was assuming that snort monitors packets in HOME_NETWORK in promiscous mode,Kindly correct me if i am wrong. Snort can only monitor packets which can be seen at the network card, even in promiscuous mode. Usually the switch in a network will only send out packets on the port where the specific device is connected. This means that Snort has to be ...


1

Difficult to say without knowing the network topology, but I'd guess that you've not got snort set up on a SPAN port or similar. If your network is switched, then the snort box won't be receiving traffic which isn't either directed to it, or the broadcast. It may be listening in promiscuous mode, but if the packets aren't actually hitting the interface, ...


2

There are two primary ways to scan for the IoCs in Yara files: Against files on disk using a tool such as Loki.exe. Loki requires yara and will scan Windows machines looking for IoCs. Versus memory dumps available through a variety of memory-dumping tools. The Volatility Framework includes a plugin called yarascan with can specify Yara-rules file by using ...



Top 50 recent answers are included