Questions tagged [detection]
Detection is the act of discovering and/or determining the existence, presence, or fact of something.
242
questions
3
votes
2
answers
454
views
Has malware detected mitmproxy and similar tools used to intercept and analyze malicious traffic?
When trying to analyze malware, have there been cases where malware detected the use of mitmproxy and ceased operation?
If that has happened, would it be a good idea to be constantly using a proxy as ...
- 1,368
0
votes
0
answers
38
views
Windows 10 Cybersecurity on Stand-Alone Computer
I have been asked to investigate what capabilities exist within Windows 10 where the environment for this system is isolated. I believe it would not be able to benefit from an enterprise security ...
- 255
0
votes
1
answer
98
views
Has there ever been a case of dangerous industrial malware, which would destroy motherboards and similar PC components and how to protect [duplicate]
I heard many years ago from word of mouth that this kind of malware exists, which could for example blow up capacitors in your PC.
Has such malware or something even remotely similar ever existed?
...
- 1,368
1
vote
3
answers
188
views
How can I have my process detect if antivirus injected a module or DLL to it?
I am writing an installer process (.exe). My installer deploys different components. It will add registry entries, copy files, copy files over the network, remote execute, remote PowerShell, local ...
- 113
0
votes
1
answer
170
views
Misuse vs anomaly detection alerts
Adam always reads his e-mails on Sundays around 5 pm. This Saturday,
at 11 am, he accessed his inbox. Which will generate a false positive?
Source slide 10/41
Misuse-based IDS or anomaly-based IDS? ...
- 1
0
votes
1
answer
100
views
Remote detection of a trojan - how can it be done?
In this blog post CyberCube claim:
CyberCube observed a malware infection on Colonial Pipeline’s network named “trojan.win32.razy.gen”
I'm really curious to know how this could be done from outside ...
- 11
0
votes
4
answers
197
views
Mouse moving while unattended, how can I check for intrusions
A few hours ago, I spotted my unattended mouse moving and seeming to click on tabs. I promptly rebooted my system and removed Teamviewer (it's the only remote connection app that I have installed), ...
- 101
0
votes
0
answers
87
views
Is every packet of a hostile network flow hostile?
We are building a packet based anomaly detection system and I'm trying to find labeled packets.
Such dataset doesn't exist based on my search, but I can find labeled flows.
Can we say that every ...
- 101
1
vote
0
answers
80
views
watch-video.net malware and preventing these types of infections at the network level [closed]
How does a computer get infected with watch-video.net malware, and why aren't popular tools like windows defender or malwarebytes able to detect and remove it? Is there a practical way to prevent ...
- 225
1
vote
1
answer
150
views
Is it possible to completely obfuscate proxy servers?
Stripe's fraud detection documentation claims it has
Proxy Detection
When I search for how it might be detecting traffic from proxies, I see this great answer, which show how to detect that traffic.
...
- 1,214
54
votes
6
answers
20k
views
If malware does not run in a VM why not make everything a VM?
There is a lot of malware that can detect whether it is running inside a VM or sandboxed environment and if such environment is detected it can conceal it self and not execute. So why not make ...
- 1,145
0
votes
1
answer
298
views
Is there any advantages in using a Network Intrusion Detection System, when already having a EDR solution?
Does implementing a Network Intrusion Detection System (NIDS) give you any advantages over an Endpoint Detection and Response (EDR) solution?
I've been trying to do research on this, but are ...
- 1
0
votes
1
answer
168
views
How does one detect and deter golden SAML attacks?
How does one defend, detect and deter golden SAML attacks?
3
votes
0
answers
167
views
Can the glue of glitter-hot-glue sticks be used to provide evidence of electronics-hardware tampering?
I've been researching low-cost, yet strong, tamper-evident mechanisms, and purchased some low-cost glitter-hot-glue sticks as part of this research. The Amazon page advertising the sticks, seems to ...
0
votes
1
answer
2k
views
Is it safe to use an executable if only unknown antiviruses detected something?
Recently I downloaded Open Shell application and checked it via VirusTotal.
Most famous antiviruses like Bitdefender, Nrothon, Kaspersky found nothing.
But some of antiviruses thing there are some bad ...
- 225
1
vote
1
answer
189
views
Reverse shell with python client side becomes detectable after converting with pyinstaller as exe file
When converting the reverse shell client.py python file to exe with pyinstaller it becomes detectable as a trojan on virustotal.com with most antivirus.
Here is my client file:
import os, socket, ...
- 111
1
vote
1
answer
116
views
Is it possible to ensure detection and logging of all attempts to copy data out of a system?
I am cross-posting this question from Serverfault, because I am in doubt where it fits best.
Say I have a server set up for processing sensitive data. The few authorised users of the system are ...
- 111
1
vote
1
answer
99
views
Are there services to detect data breaches?
There have been quite a lot of data breaches in the past and I wonder how the companies got to know them. Were they only finding it in the news? Did individuals inform them?
What about small data ...
- 3,882
0
votes
1
answer
148
views
Insider threats vs. insider attacks
I understand that a threat is a possible security violation that might exploit the vulnerability of a system, and a attack is an action on a system that harms the organisation in some way. Therefore, ...
- 1
1
vote
1
answer
164
views
Is the perfect MITM attack possible?
Let's imagine a data link layer level MITM attack. Is it possible to fulfill all of the following points?
you completely hide your identity by forging your own MAC address
you create malformed ...
user238715
0
votes
2
answers
130
views
How can I determine if a malware sample is morphic? (polymorphic, metamorphic, etc)
I want to do a malware test that specifically uses recent morphic malware samples (polymorphic, metamorphic, etc). There are a couple of good sources I can pull samples from, but I need to know if ...
- 1
3
votes
3
answers
226
views
Logging connections to hardcoded IP addresses
On a Windows system, I'm able to get a good idea of most outgoing traffic by enabling DNS query logging, but I am missing those connections that are made straight to hardcoded IP addresses. What would ...
- 991
2
votes
0
answers
122
views
Deciding between MDR solutions offering endpoint agents with or without an additional network appliance?
There are a number of different Managed Security Service Providers (MSSPs) offering managed detection and response services. They tend to use what is called an endpoint agent, while only some use a ...
- 21
0
votes
1
answer
141
views
How to check big video file if can't check it entirely?
There size limit on VirusTotal, some videos are very big. What if cut off part from the video and send part of it. Is it possible? What part of it, where malware can be?
- 225
0
votes
0
answers
277
views
What are the main differences between a covert timing channel and a covert storage channel?
I am trying to find the differences between a covert timing channel and a covert storage channel in terms of detectability, performance, features, and any other advantages and disadvantages.
Is ...
- 13
1
vote
1
answer
338
views
Is there any method or tool other than nmap for the detection of an OS?
I wanted to know if there was any other way to detect the OS of a network (other than nmap) since nmap doesn't detect most versions of Windows 10 at all and identifies them as a different OS ...
- 121
2
votes
1
answer
751
views
Can an ISP redirecting DNS traffic be detected by the end user?
If an ISP wants to gather profiles on users, or block certain websites, they can fairly easily redirect outgoing UDP traffic to port 53 to their own DNS servers.
How could this be detected by the end ...
- 21.5k
2
votes
4
answers
306
views
Ransomware aversion and identification techniques
I don't think there's a need to go into the background here, but identification of the process may be better explored.
From a developer pov, at a high level, the files are modified, by virtue of the ...
- 181
2
votes
1
answer
169
views
How can I as middleman verify whether a phishing site is valid if the scam listens only on the referrer link and blocks any other access methods?
How can I as a trusted user of a middleman company (such as PhishTank) verify whether a phishing site is valid if the scam listens only on a unique referrer link(randomly created) and is blocking any ...
- 432
-1
votes
1
answer
150
views
Does the term "malware signature" always refer to a pattern of bytes? [duplicate]
I know that traditionally a malware signature is a pattern of bytes in a program. While reading Joxean Koret and Elias Bachaalany's "Antivirus Hacker's Handbook" I saw that the authors categorized the ...
- 345
0
votes
1
answer
739
views
Yara condition count operator with wildcard [closed]
I have a yara rule that looks for multiple strings in a file and fires if the count is greater than 3. But how would I change the condition statement to only fire if greater than 3 but less than 5?
...
- 143
1
vote
1
answer
571
views
What is "rule-based" analysis in malware detection?
I've read a few articles that describe the heuristic detection used by AVs as being either "weight-based" or "rule-based". The weight-based aspect seems to make sense, but I don't understand what "...
- 345
1
vote
0
answers
264
views
Snort rules to detect metasploit's trojan [duplicate]
I'm currently working on Snort and I'm trying to detect meterpreter sessions in reverse TCP or HTTPS, a Trojan ...
Does anyone know snort rules in order to detect this? Despite my research, I found ...
- 11
0
votes
0
answers
117
views
Antivirus and it's role in detecting payload execution?
My first question is this:
1) Antivirus software works using signature based detection. Signature based detection evaluates items (maybe not the right word?) based upon a big database of known threats....
0
votes
1
answer
280
views
What are the heuristic detection techniques most often used in modern AVs? [closed]
Whenever I read books or academic papers and the subject of heuristic malware detection is brought up they always say the same thing: "it can be either static or dynamic", "it may use emulation", "may ...
- 15
2
votes
1
answer
1k
views
What is an Albert sensor?
Recent news articles have started to talk about government networks deploying "Albert sensors" (e.g., this article). What is an Albert sensor? And how effective is it?
Going purely from context, it ...
- 98.3k
0
votes
2
answers
2k
views
Can my father's smartphone be compromised?
My father told me that he allowed the installation of apps from unknown sources when he was asked to do it to go further with something (he said that he doesn't remember when or what he was doing).
...
- 747
4
votes
2
answers
247
views
Why malwares need to be light
I am learning about how malwares work and I read that a lot of them are written in assembly or C to keep the binary size as small as possible.
In an example C++ source code, authors decided to remain ...
- 41
0
votes
1
answer
5k
views
Snort rule for syn flood attacks - Limiting number of alerts
So I have a snort rule that detects syn flood attacks that looks like this:
alert tcp any any -> $HOME_NET 80 (msg:”SYN Flood - SSH"; flags:S;
flow: stateless; detection_filter: track by_dst, ...
- 1
2
votes
1
answer
325
views
What features would you use to detect a backdoor or a bot installation?
I was reading a document about logging and analysis. The document talks about statistical analysis and machine learning techniques to detect some attack scenarios. For instance, If you want to detect ...
- 170
39
votes
7
answers
32k
views
Is it possible to detect 100% of SQLi with a simple regex?
I'm wondering if it is possible to detect 100% of the possible SQLi attacks using a simple regex.
In other words, using very simple PHP code as an example:
if (preg_match("/select/i", $input)) {
...
- 15.3k
152
votes
19
answers
42k
views
Has it been mathematically proven that antivirus can't detect all viruses?
What analysis was Bruce Schneier referencing when he wrote:
Viruses have no “cure.” It’s been mathematically proven that it is always possible to write a virus that any existing antivirus program ...
- 1,235
0
votes
1
answer
193
views
How can I detect an infection in a database?
Detecting infected files in a website or web application is very easy: you just need to compare the files with a clean backup or the original source (for example with diff) and that's it. However, ...
- 15.3k
1
vote
0
answers
91
views
What makes detection of optimized-away memory clearing non-trivial?
In this 35C3 talk, it is said that while it is possible to manually inspect whether a package optimizes away memset() that clears sensitive memory, doing it automatically would be challenging. ...
- 6,514
2
votes
2
answers
324
views
Should you consider a system compromised if someone could have physically accessed it, but you have no evidence they did?
An old adage is that if an adversary physically accessed your system, you should consider it compromised. My question is, what if they could have, but you have no evidence they did?
For example, let ...
- 2,937
1
vote
1
answer
227
views
100% detectable backdoor attacks on network
Every article I have read on backdoor attack prevention says pretty much this:
Protecting against them may be difficult.
I am tired of reading how it can be ~difficult~ to protect against. ...
- 558
0
votes
0
answers
299
views
Heuristics-based vs behavioral malware detection
I'm working on my thesis and I have a couple questions about differences between heuristics-based and behavioral malware detection.
Does heuristics-based detection rely only on statically examining ...
- 131
0
votes
1
answer
189
views
Does Real-time typing view in chats invades privacy? Are there any detection and prevention methods?
When a customer talks with a representative of a company in a chat on a web-page, it is possible that they are actually sending every keystroke to their server before you hit the enter or click the ...
- 5,389
1
vote
1
answer
101
views
Detecting if an agent is listening to specific messages
Is there a way to detect if an agent Z is listening to (and acting on) messages from Y? I can observe the messages that Y sends and the actions that Z takes, but I know Z is also listening (and acting ...
- 111
2
votes
1
answer
1k
views
Error detection capability of SHA-256
If we use SHA-256 checksum to detect corruptions to a file, what is its capability in terms of missed errors?
For example, reading the page about error correction and detection here, under the ...
- 165