Questions tagged [detection]
Detection is the act of discovering and/or determining the existence, presence, or fact of something.
1
vote
1answer
24 views
Datasets dedicated for SIEM systems
I am looking for data sets published by researchers or freelancers which can be used for the purpose of SIEM testing and evaluations. The goal is to test the classification (and later correlation) for ...
34
votes
5answers
15k views
How to detect when files from my USB were copied to another PC?
I accidentally gave my USB to my friend and then I realized it had some important files of mine. Is there any way I can know if he got something from the USB?
0
votes
0answers
14 views
Alternatives to Provos`es Systrace [closed]
Is there a program for real time monitoring binaries` syscalls with gui interfaced policies deny or allow (so called intrusion detection) like was Systrace written by Niels Provos?
Systrase in ...
0
votes
1answer
30 views
How to restrict plugins/tools like Netcraft and Builtwith to detect server side technologies?
My organization wants to restrict all the plugins/tools like Netcraft and Builtwith to detect all the server side technologies for security reason like platform, operating system name and version, web ...
0
votes
0answers
48 views
Flash drive rootkit [closed]
I have reason to believe rootkit was transferred to my machine via a flash drive I tried several antivrus and they don't detect it, any suggestions on how to detect it?
2
votes
1answer
63 views
Why dont anti-viruses detect encrypted viruses in decryption?
Some viruses are encrypted so that the anti-virus cant identify them, but what i dont understand is, why wouldnt the anti-virus doesnt detect them, considering they have to decrypt themselves before ...
3
votes
2answers
70 views
How to find what files in a zip are malware using Virustotal
I have a malware infected android phone and I am suspicious that some of the binaries in system/bin/ and system/xbin/ are malware so I decided to dump the system and zipped the contents of bin and ...
1
vote
0answers
34 views
Snort not working with IDSWakeup
I have setup Snort with the registered user rules installed.
I tested first by making the following rule in local.rules:
alert icmp any any -> $HOME_NET any (msg:"ICMP test"; sid:10000001; rev:...
2
votes
2answers
92 views
Is there an easy way to detect clients that ignore certificate validation errors (in production)?
I see this happening allot: developers need to test stuff, have a self-signed certificate that causes an error, and they just switch verification off globally (like in this example). The hack gets ...
1
vote
0answers
22 views
How can identify potential malware from the list of sessions established between my PC with devices on the internet [closed]
I wish to know if there are any software tool(s) that allow me see all established sessions from my PC and flag those connections that are potentially malware.
I prefer GUI type tool but will also ...
-1
votes
1answer
67 views
Audio steganography and DRM
I recently made a post about an audio steganography program and had another concern I thought I might ask. I understand that most music has DRM in them. If I hide secret files in audio files with DRM ...
1
vote
1answer
152 views
How to create a proxy so that no website or web service can know that I am connecting through a proxy?
I want a proxy, preferably my own but I would be glad if there is a reliable service already, that is undetectable. Obviously, it does not send X-Forwarded-For. But it has to be much more than that to ...
1
vote
0answers
57 views
Which Anti-Virus companies share their signature databases?
I recently heard that AVG and AVAST shared their malware signature databases (avast forum)
Which AV vendors share their signature databases or use the same engine for detecting malwares? Based on ...
0
votes
0answers
83 views
If I'm using private mode for google chrome and a free web proxy, is it still possible for the school to monitor what I'm looking up on my macbook? [duplicate]
A quick question just be safe, is it still possible for a school to monitor what I'm looking up and what websites I'm accessing if I'm in private mode on google chrome canary while also using ...
1
vote
0answers
170 views
How can XML External Entity attacks be detected?
XML External Entity attacks have been identified as an OWASP top 10 web application vulnerability. Whilst there seems to be extensive information on what an XML external entity attack is and how it ...
1
vote
1answer
188 views
MITM based on ARP spoofing
I fail to understand how a MITM attack sniffs packets and modifies them.In the case of ARP spoofing although the attacker has spoofed the MAC address of a host, how does he modify it?
if he listen to ...
2
votes
0answers
51 views
What caused these massive spikes in malware sites detected by Google in July 2012 and January-February 2014?
Google's Transparency Report shows pretty huge spikes in malware sites detected by crawlers in July 2012 and in January/February 2014. I can't find any record of what these spikes were caused by ...
0
votes
1answer
53 views
Motion sensors - detectable when using mobile network?
Motion sensors are a good way to be informed of any activity at our house. Many modern motion sensors have the possibility to notify the user using an internet connection using Wi-Fi or even mobile ...
2
votes
0answers
122 views
What is the best way to test my anomaly detection system?
I have an IDS (Intrusion Detection System) built in C and I need to test it with real traffic. It is an anomaly detection system, so I need to train it with normal traffic first.
The IDS that I built ...
-2
votes
1answer
127 views
Why arent all hackers traced ? ( network based attackers or malware which communicate with CNC servers)
When hackers use tor or irc or proxies to attack or use CNC servers behind these to evade. Why can't they be traced?
For example, something like wanna cry or any other known malware, when something ...
-3
votes
2answers
102 views
Impossible VM-detection countermeasures
Are there any vm-detection techniques (of malware) which are impossible to mitigate in your vm?
If yes, which?
4
votes
2answers
512 views
Detecting C2 traffic over DNS?
Let's assume I have a large enterprise network (thousands of nodes) and somewhere on that network there is malware communicating over DNS for C2. Let's assume the requests are designed such that the ...
6
votes
1answer
286 views
Mitigating Meltdown by checking the faulting address in every page fault?
Short question
Would checking if the faulting address for every page fault points to kernel memory reliably detect an attempted Meltdown exploit, on systems that lack Intel TSX (and thus cannot ...
6
votes
2answers
265 views
AVG detects Kaspersky update files as infected (trojan, infected, malware)
(Note: update at end of Q)
On a Mac, I am using AVG as the primary AV. In addition to this, I have a few scanners (Bitdefender and Malwarebytes) that I update and use periodically. Recently I decided ...
2
votes
1answer
1k views
How to detect malicious fb2 & epub file?
Is fb2 & epub files can be malicious like pdf? If yes, so how I can detect it manually ?
Malicious RTF, doc, docx, xls, ppt files can be detected via OLETOOLS.
Malicious PDF files via peepdf, ...
4
votes
1answer
542 views
How can you detect kernel exploits?
Is there something that all kernel exploits have in common?
Sure, they all exploit the kernel, but I'm more interested in the underlying mechanisms or the result. At the moment my interest goes ...
-2
votes
1answer
48 views
Trying to detect a firewall
I have some HTML that was detected by one of my scripts firewall detections, it looks like this:
<!---
HTTP 1.1
Status Code: 403
HTTP Headers: {'Content-Length': '1233', 'X-Powered-By': 'ASP.NET', ...
3
votes
1answer
326 views
What is good metric for detecting data exfiltration on covert channel?
Considering the scenario when the attacker is able to exfiltrate sensitive data from compromised system to external network or Internet, but there are only limited ways to achieve this because the ...
-1
votes
2answers
72 views
WAF/IDS detection question
I've been writing scripts to identify WAF's on websites, and have come across one that appears, A LOT.
The HTML always looks like this:
<title>403 Forbidden</title>
</head><...
0
votes
1answer
433 views
Combine SNORT detection and log with active response OSSEC
As far as i know, NIDS implemented in Network layer and HIDS in Host-based layer, Is it possible for NIDS( for example: Snort or suricata ) log that will included in HIDS(for example: OSSEC) log too ? ...
4
votes
1answer
285 views
Drawbacks of ML in cyber security?
I did some research on the topic (as I'm new to it) and it frankly seems too good to be true. A company called Darktrace for instance, makes use of AI algorithms and ML to autonomously detect threats ...
4
votes
3answers
1k views
Does nmap trace back to you?
I just got certified in CEH and learned A LOT about nmap and how it really manipulates the three-way-handshake to get some cool information.
I have a question about possible detection problems.
...
0
votes
1answer
185 views
How to efficiently locate malware on an endpoint? [closed]
I have a question from one of the interviews I had, I have no knowledge in system security and so I didn't know how to approach each. The question was:
A customer suspects that one of his endpoints ...
1
vote
1answer
335 views
Shadowsocks: Doesn't communication with just one server look suspicious to the GFW?
From what I understand, Shadowsocks masks SOCKS5 traffic as HTTPS traffic, so that the GFW cannot detect it by packet inspection. Shadowsocks can be installed on my own server, naturally. For usage, I ...
24
votes
4answers
3k views
Reduce Noise when Penetration Testing
Recently I participated in a capture the flag competition which was attached with SOC analysis teams monitoring our traffic.
There we were told that many tools were very noisy. Eg Sqlmap which has ...
1
vote
1answer
321 views
IAT Hooking questions?
I have researched IAT hooking by malware and i still have a few questions:
If the IAT of the program in memory is different to the IAT of the static program (before it has been ran) does this imply a ...
2
votes
2answers
137 views
Is there a way to prevent comments from being abused for command and control?
Botnets typically are coordinated over protocols like HTTP or IRC. However, to make such command and control traffic harder to spot, attackers have occasionally turned to other channels, including ...
0
votes
2answers
123 views
PDF parser and OPcodeExtraction [closed]
I'm performing an university project on malware detection. Specifically I need:
- extract javascript from a PDF, ...
-1
votes
2answers
217 views
famous anti virus fail to detect simple malicious software (detection problems) [closed]
I am a master student and I am working on a mini-project on virus recognition and how to get rid of the virus.
I had to infect my virtual machine and then clean the virus or Trojan using various ...
1
vote
0answers
210 views
Heuristic Malware Detection Methods
I would like to know some basic heuristic detection methods in detail because when I do research there is only a general overview of heuristics and not what methods are used to achieve it. I would ...
1
vote
1answer
183 views
What would be an example of 'AI' in your average security appliance?
It seems that more and more Anti-Virus and other security related business solutions are adding the 'AI' and 'machine learning' buzzwords to their marketing repertoire. However, the only 'AI' I ever ...
0
votes
0answers
22 views
Can a single breach detection product include more than one of these approaches?
Can a single breach detection system include more than one of these approaches?
UBEA which looks at user behavior
Network Traffic Analytics (NTA) which focuses on network traffic
Threat Intelligence ...
2
votes
1answer
505 views
How does an iPhone app detect a proxy?
I was interested to lookup the traffic of an app and I installed MITM-proxy on my Mac and set up the connection to it on my iPhone.
Actually everything worked like it should, except that the main ...
1
vote
2answers
2k views
What is the difference between Heuristic-based and Behaviour-based virus scanning?
I'm struggling to see the difference as all papers and notes I've read seem to contradict each other.
Can someone please explain to me the difference between heuristic and behaviour based virus ...
1
vote
0answers
46 views
Can using simultaneous intrusion detection systems (IDS) create conflicts?
Can simultaneously using 2 or more intrusion detection systems (IDS) on the same computer or network create conflicts ?
Talking about tools (as examples) such as but not limited to: tripwire, bro, ...
5
votes
2answers
4k views
HIDS - Choosing between regular OSSEC or Wazuh fork
I intend to set up OSSEC and noticed there seem to be two main flavours: plain OSSEC and Wazuh fork.
From what I've been able to gather (from Wazuh's website and documentation), the main advantages ...
0
votes
1answer
53 views
Determining if System or Network was scanned with a Network or Vulnerability Scanner
Everywhere I read is to be careful using network scanners and that vulnerability scanners should only be used in active reconnaissance as scanners tend to be noisy.
How would a network administrator ...
1
vote
1answer
927 views
Host sending massive amount of TCP/IP Packets with RA Flag: Part of DDoS Attack?
I have a host on the Network that tries to send TCP/IP Packets to various servers. The DST Port is always 80 or 443 and the Flags set are RST and ACK. These Packets are blocked by our firewall. I did ...
2
votes
0answers
49 views
Obscuring/detecting changes to a digital photograph
Note: I'm asking this here because it seems to be a better fit for security than for photography, since it deals with data manipulation and forensics.
With so much of our modern security based on ...
1
vote
5answers
719 views
Does investigating the .eml file of an email suffice to deem it malicious?
Let's say that I want to test whether an email in my inbox is safe or not. Can I tell this with 100% certainty just by investigating the .eml file or are there some other places to check for absolute ...
