Questions tagged [detection]
Detection is the act of discovering and/or determining the existence, presence, or fact of something.
239
questions
0
votes
3answers
99 views
How can I have my process detect if antivirus injected a module or DLL to it?
I am writing an installer process (.exe). My installer deploys different components. It will add registry entries, copy files, copy files over the network, remote execute, remote PowerShell, local ...
1
vote
1answer
144 views
Misuse vs anomaly detection alerts
Adam always reads his e-mails on Sundays around 5 pm. This Saturday,
at 11 am, he accessed his inbox. Which will generate a false positive?
Source slide 10/41
Misuse-based IDS or anomaly-based IDS? ...
-1
votes
1answer
89 views
Remote detection of a trojan - how can it be done?
In this blog post CyberCube claim:
CyberCube observed a malware infection on Colonial Pipeline’s network named “trojan.win32.razy.gen”
I'm really curious to know how this could be done from outside ...
0
votes
4answers
183 views
Mouse moving while unattended, how can I check for intrusions
A few hours ago, I spotted my unattended mouse moving and seeming to click on tabs. I promptly rebooted my system and removed Teamviewer (it's the only remote connection app that I have installed), ...
0
votes
0answers
75 views
Is every packet of a hostile network flow hostile?
We are building a packet based anomaly detection system and I'm trying to find labeled packets.
Such dataset doesn't exist based on my search, but I can find labeled flows.
Can we say that every ...
1
vote
0answers
71 views
watch-video.net malware and preventing these types of infections at the network level [closed]
How does a computer get infected with watch-video.net malware, and why aren't popular tools like windows defender or malwarebytes able to detect and remove it? Is there a practical way to prevent ...
1
vote
1answer
112 views
Is it possible to completely obfuscate proxy servers?
Stripe's fraud detection documentation claims it has
Proxy Detection
When I search for how it might be detecting traffic from proxies, I see this great answer, which show how to detect that traffic.
...
54
votes
6answers
20k views
If malware does not run in a VM why not make everything a VM?
There is a lot of malware that can detect whether it is running inside a VM or sandboxed environment and if such environment is detected it can conceal it self and not execute. So why not make ...
0
votes
1answer
227 views
Is there any advantages in using a Network Intrusion Detection System, when already having a EDR solution?
Does implementing a Network Intrusion Detection System (NIDS) give you any advantages over an Endpoint Detection and Response (EDR) solution?
I've been trying to do research on this, but are ...
0
votes
1answer
148 views
How does one detect and deter golden SAML attacks?
How does one defend, detect and deter golden SAML attacks?
4
votes
0answers
154 views
Can the glue of glitter-hot-glue sticks be used to provide evidence of electronics-hardware tampering?
I've been researching low-cost, yet strong, tamper-evident mechanisms, and purchased some low-cost glitter-hot-glue sticks as part of this research. The Amazon page advertising the sticks, seems to ...
1
vote
1answer
1k views
Is it safe to use an executable if only unknown antiviruses detected something?
Recently I downloaded Open Shell application and checked it via VirusTotal.
Most famous antiviruses like Bitdefender, Nrothon, Kaspersky found nothing.
But some of antiviruses thing there are some bad ...
1
vote
1answer
152 views
Reverse shell with python client side becomes detectable after converting with pyinstaller as exe file
When converting the reverse shell client.py python file to exe with pyinstaller it becomes detectable as a trojan on virustotal.com with most antivirus.
Here is my client file:
import os, socket, ...
1
vote
1answer
106 views
Is it possible to ensure detection and logging of all attempts to copy data out of a system?
I am cross-posting this question from Serverfault, because I am in doubt where it fits best.
Say I have a server set up for processing sensitive data. The few authorised users of the system are ...
1
vote
1answer
91 views
Are there services to detect data breaches?
There have been quite a lot of data breaches in the past and I wonder how the companies got to know them. Were they only finding it in the news? Did individuals inform them?
What about small data ...
0
votes
1answer
139 views
Insider threats vs. insider attacks
I understand that a threat is a possible security violation that might exploit the vulnerability of a system, and a attack is an action on a system that harms the organisation in some way. Therefore, ...
1
vote
1answer
145 views
Is the perfect MITM attack possible?
Let's imagine a data link layer level MITM attack. Is it possible to fulfill all of the following points?
you completely hide your identity by forging your own MAC address
you create malformed ...
0
votes
2answers
121 views
How can I determine if a malware sample is morphic? (polymorphic, metamorphic, etc)
I want to do a malware test that specifically uses recent morphic malware samples (polymorphic, metamorphic, etc). There are a couple of good sources I can pull samples from, but I need to know if ...
3
votes
3answers
206 views
Logging connections to hardcoded IP addresses
On a Windows system, I'm able to get a good idea of most outgoing traffic by enabling DNS query logging, but I am missing those connections that are made straight to hardcoded IP addresses. What would ...
2
votes
0answers
110 views
Deciding between MDR solutions offering endpoint agents with or without an additional network appliance?
There are a number of different Managed Security Service Providers (MSSPs) offering managed detection and response services. They tend to use what is called an endpoint agent, while only some use a ...
0
votes
1answer
126 views
How to check big video file if can't check it entirely?
There size limit on VirusTotal, some videos are very big. What if cut off part from the video and send part of it. Is it possible? What part of it, where malware can be?
0
votes
0answers
214 views
What are the main differences between a covert timing channel and a covert storage channel?
I am trying to find the differences between a covert timing channel and a covert storage channel in terms of detectability, performance, features, and any other advantages and disadvantages.
Is ...
1
vote
1answer
231 views
Is there any method or tool other than nmap for the detection of an OS?
I wanted to know if there was any other way to detect the OS of a network (other than nmap) since nmap doesn't detect most versions of Windows 10 at all and identifies them as a different OS ...
2
votes
1answer
653 views
Can an ISP redirecting DNS traffic be detected by the end user?
If an ISP wants to gather profiles on users, or block certain websites, they can fairly easily redirect outgoing UDP traffic to port 53 to their own DNS servers.
How could this be detected by the end ...
2
votes
4answers
296 views
Ransomware aversion and identification techniques
I don't think there's a need to go into the background here, but identification of the process may be better explored.
From a developer pov, at a high level, the files are modified, by virtue of the ...
2
votes
1answer
158 views
How can I as middleman verify whether a phishing site is valid if the scam listens only on the referrer link and blocks any other access methods?
How can I as a trusted user of a middleman company (such as PhishTank) verify whether a phishing site is valid if the scam listens only on a unique referrer link(randomly created) and is blocking any ...
-1
votes
1answer
126 views
Does the term "malware signature" always refer to a pattern of bytes? [duplicate]
I know that traditionally a malware signature is a pattern of bytes in a program. While reading Joxean Koret and Elias Bachaalany's "Antivirus Hacker's Handbook" I saw that the authors categorized the ...
0
votes
1answer
601 views
Yara condition count operator with wildcard [closed]
I have a yara rule that looks for multiple strings in a file and fires if the count is greater than 3. But how would I change the condition statement to only fire if greater than 3 but less than 5?
...
1
vote
1answer
495 views
What is "rule-based" analysis in malware detection?
I've read a few articles that describe the heuristic detection used by AVs as being either "weight-based" or "rule-based". The weight-based aspect seems to make sense, but I don't understand what "...
1
vote
0answers
247 views
Snort rules to detect metasploit's trojan [duplicate]
I'm currently working on Snort and I'm trying to detect meterpreter sessions in reverse TCP or HTTPS, a Trojan ...
Does anyone know snort rules in order to detect this? Despite my research, I found ...
0
votes
0answers
107 views
Antivirus and it's role in detecting payload execution?
My first question is this:
1) Antivirus software works using signature based detection. Signature based detection evaluates items (maybe not the right word?) based upon a big database of known threats....
0
votes
1answer
260 views
What are the heuristic detection techniques most often used in modern AVs? [closed]
Whenever I read books or academic papers and the subject of heuristic malware detection is brought up they always say the same thing: "it can be either static or dynamic", "it may use emulation", "may ...
2
votes
1answer
1k views
What is an Albert sensor?
Recent news articles have started to talk about government networks deploying "Albert sensors" (e.g., this article). What is an Albert sensor? And how effective is it?
Going purely from context, it ...
0
votes
2answers
2k views
Can my father's smartphone be compromised?
My father told me that he allowed the installation of apps from unknown sources when he was asked to do it to go further with something (he said that he doesn't remember when or what he was doing).
...
4
votes
2answers
240 views
Why malwares need to be light
I am learning about how malwares work and I read that a lot of them are written in assembly or C to keep the binary size as small as possible.
In an example C++ source code, authors decided to remain ...
0
votes
1answer
4k views
Snort rule for syn flood attacks - Limiting number of alerts
So I have a snort rule that detects syn flood attacks that looks like this:
alert tcp any any -> $HOME_NET 80 (msg:”SYN Flood - SSH"; flags:S;
flow: stateless; detection_filter: track by_dst, ...
2
votes
1answer
303 views
What features would you use to detect a backdoor or a bot installation?
I was reading a document about logging and analysis. The document talks about statistical analysis and machine learning techniques to detect some attack scenarios. For instance, If you want to detect ...
39
votes
7answers
30k views
Is it possible to detect 100% of SQLi with a simple regex?
I'm wondering if it is possible to detect 100% of the possible SQLi attacks using a simple regex.
In other words, using very simple PHP code as an example:
if (preg_match("/select/i", $input)) {
...
150
votes
19answers
42k views
Has it been mathematically proven that antivirus can't detect all viruses?
What analysis was Bruce Schneier referencing when he wrote:
Viruses have no “cure.” It’s been mathematically proven that it is always possible to write a virus that any existing antivirus program ...
0
votes
1answer
161 views
How can I detect an infection in a database?
Detecting infected files in a website or web application is very easy: you just need to compare the files with a clean backup or the original source (for example with diff) and that's it. However, ...
1
vote
0answers
83 views
What makes detection of optimized-away memory clearing non-trivial?
In this 35C3 talk, it is said that while it is possible to manually inspect whether a package optimizes away memset() that clears sensitive memory, doing it automatically would be challenging. ...
2
votes
2answers
314 views
Should you consider a system compromised if someone could have physically accessed it, but you have no evidence they did?
An old adage is that if an adversary physically accessed your system, you should consider it compromised. My question is, what if they could have, but you have no evidence they did?
For example, let ...
1
vote
1answer
179 views
100% detectable backdoor attacks on network
Every article I have read on backdoor attack prevention says pretty much this:
Protecting against them may be difficult.
I am tired of reading how it can be ~difficult~ to protect against. ...
0
votes
0answers
277 views
Heuristics-based vs behavioral malware detection
I'm working on my thesis and I have a couple questions about differences between heuristics-based and behavioral malware detection.
Does heuristics-based detection rely only on statically examining ...
0
votes
1answer
145 views
Does Real-time typing view in chats invades privacy? Are there any detection and prevention methods?
When a customer talks with a representative of a company in a chat on a web-page, it is possible that they are actually sending every keystroke to their server before you hit the enter or click the ...
1
vote
1answer
94 views
Detecting if an agent is listening to specific messages
Is there a way to detect if an agent Z is listening to (and acting on) messages from Y? I can observe the messages that Y sends and the actions that Z takes, but I know Z is also listening (and acting ...
1
vote
1answer
935 views
Error detection capability of SHA-256
If we use SHA-256 checksum to detect corruptions to a file, what is its capability in terms of missed errors?
For example, reading the page about error correction and detection here, under the ...
1
vote
0answers
77 views
Is it possible that a usb drive manufactured 3 months ago can have data copied to it that shows the file last modified date before manufacturing date? [closed]
I have some data that needs to be handed to a friend. I don't want to give the original drive (drive-1), so I plan to purchase a drive (drive-copy) and copy data to it. The data copied will still show ...
64
votes
5answers
17k views
Can Beehive detect a Snowden-like actor?
In a seminar, one of the Authors of Beehive: Large-Scale Log Analysis for Detecting Suspicious Activity in Enterprise Networks said that this system can prevent actions like Snowden did.
From their ...
0
votes
2answers
2k views
If a file on USB drive shows a certain "date modified" time in the windows explorer, can the correct added date/time be checked for the file?
If someone copied files from a drive-1 to usb-drive-2, then it seems the directories and files get the original modified time from drive-1 in some cases and in some cases not.
Can it be checked if ...