Questions tagged [detection]
Detection is the act of discovering and/or determining the existence, presence, or fact of something.
253
questions
1
vote
0
answers
62
views
Base64 encoded payload detection rule on crowdstrike
I am new to threat detection. I was figuring out a way for crowdstrike falcon to block the execution of malicious base64 encoded payloads on a Linux machine.
Wanted to know if a setting prevention ...
- 11
2
votes
1
answer
45
views
Difference between PS Remoting and Winrs from a detection standpoint
From a detection standpoint, when pivoting inside a network what difference (if any) is there between establishing a remote connection between using Enter-PSSession -ComputerName PC1 vs winrs -r:PC1 ...
- 303
7
votes
2
answers
4k
views
How should I report a Man-in-the-Middle attack in my workplace?
I work at a small-to-medium business. Most of my coworkers were born in the 1960s and do not have a background in computer science. I have a background in computer science, but I specialize in ...
- 181
0
votes
1
answer
88
views
SACL for shadow copies
I'm researching the topic of detecting registry dump from disk shadow copies and realize that I don't see any specific events in the Windows and Sysmon logs.
I tried a simple copy with the command:
...
- 11
1
vote
1
answer
369
views
Bypassing root detection qualify as a vulnerability?
I am working on security testing of an android application. There is a root detection in the Android application. objection, frida etc. It is possible to bypass this with ways.
My main question is: ...
- 35
1
vote
1
answer
178
views
Understanding XDR Detection Methods
I'm interested in security and redteaming in particular, and as I'm learning about the subject I'm trying to find out what kind of things a blue team EDR/XDR solution will look for as part of its ...
- 11
0
votes
1
answer
294
views
How does Windows Defender for Mac block applications and how can people evade the block?
I am using MS Defender for Mac to specify a list of unwanted applications on the managed devices in my company. I am concerned that some users try to evade the detection by altering the binaries of ...
- 51
0
votes
1
answer
113
views
Any (opensource) tool that we can use to detect if our computers has been installed applications that have proxies services
Read something like this on reddit "someone can also be a regular user who does not read terms and conditions of apps that they install. Some apps might include code that will enable them to run ...
- 157
1
vote
0
answers
85
views
Effectiveness of USB flash testing software
So I've just had an SD card ruined & while it's not very expensive, I'd rather have it last me a much, much longer time. As a precaution going forward now, I'd like to be able to detect right away ...
- 111
1
vote
0
answers
102
views
Kusto to Osquery translator?
Osquery is a great open standard for collecting data from endpoints, using SQL syntax.
Kusto is a new Microsoft language for collecting data from Windows endpoints, using syntax which is almost--but ...
- 3,321
3
votes
2
answers
1k
views
Has malware detected mitmproxy and similar tools used to intercept and analyze malicious traffic?
When trying to analyze malware, have there been cases where malware detected the use of mitmproxy and ceased operation?
If that has happened, would it be a good idea to be constantly using a proxy as ...
- 1,633
0
votes
0
answers
102
views
Windows 10 Cybersecurity on Stand-Alone Computer
I have been asked to investigate what capabilities exist within Windows 10 where the environment for this system is isolated. I believe it would not be able to benefit from an enterprise security ...
- 255
0
votes
1
answer
154
views
Has there ever been a case of dangerous industrial malware, which would destroy motherboards and similar PC components and how to protect [duplicate]
I heard many years ago from word of mouth that this kind of malware exists, which could for example blow up capacitors in your PC.
Has such malware or something even remotely similar ever existed?
...
- 1,633
3
votes
3
answers
1k
views
How can I have my process detect if antivirus injected a module or DLL to it?
I am writing an installer process (.exe). My installer deploys different components. It will add registry entries, copy files, copy files over the network, remote execute, remote PowerShell, local ...
- 133
0
votes
1
answer
455
views
Misuse vs anomaly detection alerts
Adam always reads his e-mails on Sundays around 5 pm. This Saturday,
at 11 am, he accessed his inbox. Which will generate a false positive?
Source slide 10/41
Misuse-based IDS or anomaly-based IDS? ...
- 141
2
votes
0
answers
964
views
SVCHOST Executed without any arguements [closed]
Our SIEM has a Sigma rule that alerts when svchost is launched without any arguments. The logs are from a domain controller which unfortunately I don't have access to to verify. I will be reaching ...
- 21
0
votes
1
answer
140
views
Remote detection of a trojan - how can it be done?
In this blog post CyberCube claim:
CyberCube observed a malware infection on Colonial Pipeline’s network named “trojan.win32.razy.gen”
I'm really curious to know how this could be done from outside ...
- 11
0
votes
4
answers
245
views
Mouse moving while unattended, how can I check for intrusions
A few hours ago, I spotted my unattended mouse moving and seeming to click on tabs. I promptly rebooted my system and removed Teamviewer (it's the only remote connection app that I have installed), ...
- 101
0
votes
0
answers
160
views
Is every packet of a hostile network flow hostile?
We are building a packet based anomaly detection system and I'm trying to find labeled packets.
Such dataset doesn't exist based on my search, but I can find labeled flows.
Can we say that every ...
- 101
1
vote
0
answers
146
views
watch-video.net malware and preventing these types of infections at the network level [closed]
How does a computer get infected with watch-video.net malware, and why aren't popular tools like windows defender or malwarebytes able to detect and remove it? Is there a practical way to prevent ...
- 225
1
vote
1
answer
373
views
Is it possible to completely obfuscate proxy servers?
Stripe's fraud detection documentation claims it has
Proxy Detection
When I search for how it might be detecting traffic from proxies, I see this great answer, which show how to detect that traffic.
...
- 1,320
54
votes
6
answers
21k
views
If malware does not run in a VM why not make everything a VM?
There is a lot of malware that can detect whether it is running inside a VM or sandboxed environment and if such environment is detected it can conceal it self and not execute. So why not make ...
- 1,155
0
votes
1
answer
637
views
Is there any advantages in using a Network Intrusion Detection System, when already having a EDR solution?
Does implementing a Network Intrusion Detection System (NIDS) give you any advantages over an Endpoint Detection and Response (EDR) solution?
I've been trying to do research on this, but are ...
- 1
0
votes
1
answer
337
views
How does one detect and deter golden SAML attacks?
How does one defend, detect and deter golden SAML attacks?
- 1,073
3
votes
0
answers
237
views
Can the glue of glitter-hot-glue sticks be used to provide evidence of electronics-hardware tampering?
I've been researching low-cost, yet strong, tamper-evident mechanisms, and purchased some low-cost glitter-hot-glue sticks as part of this research. The Amazon page advertising the sticks, seems to ...
0
votes
1
answer
2k
views
Is it safe to use an executable if only unknown antiviruses detected something?
Recently I downloaded Open Shell application and checked it via VirusTotal.
Most famous antiviruses like Bitdefender, Nrothon, Kaspersky found nothing.
But some of antiviruses thing there are some bad ...
- 225
1
vote
1
answer
356
views
Reverse shell with python client side becomes detectable after converting with pyinstaller as exe file
When converting the reverse shell client.py python file to exe with pyinstaller it becomes detectable as a trojan on virustotal.com with most antivirus.
Here is my client file:
import os, socket, ...
- 111
1
vote
1
answer
178
views
Is it possible to ensure detection and logging of all attempts to copy data out of a system?
I am cross-posting this question from Serverfault, because I am in doubt where it fits best.
Say I have a server set up for processing sensitive data. The few authorised users of the system are ...
- 111
1
vote
1
answer
142
views
Are there services to detect data breaches?
There have been quite a lot of data breaches in the past and I wonder how the companies got to know them. Were they only finding it in the news? Did individuals inform them?
What about small data ...
- 3,942
0
votes
1
answer
216
views
Insider threats vs. insider attacks
I understand that a threat is a possible security violation that might exploit the vulnerability of a system, and a attack is an action on a system that harms the organisation in some way. Therefore, ...
- 1
1
vote
1
answer
246
views
Is the perfect MITM attack possible?
Let's imagine a data link layer level MITM attack. Is it possible to fulfill all of the following points?
you completely hide your identity by forging your own MAC address
you create malformed ...
user238715
0
votes
2
answers
171
views
How can I determine if a malware sample is morphic? (polymorphic, metamorphic, etc)
I want to do a malware test that specifically uses recent morphic malware samples (polymorphic, metamorphic, etc). There are a couple of good sources I can pull samples from, but I need to know if ...
- 1
3
votes
3
answers
381
views
Logging connections to hardcoded IP addresses
On a Windows system, I'm able to get a good idea of most outgoing traffic by enabling DNS query logging, but I am missing those connections that are made straight to hardcoded IP addresses. What would ...
- 1,011
2
votes
1
answer
169
views
Deciding between MDR solutions offering endpoint agents with or without an additional network appliance?
There are a number of different Managed Security Service Providers (MSSPs) offering managed detection and response services. They tend to use what is called an endpoint agent, while only some use a ...
- 21
0
votes
1
answer
388
views
How to check big video file if can't check it entirely?
There size limit on VirusTotal, some videos are very big. What if cut off part from the video and send part of it. Is it possible? What part of it, where malware can be?
- 225
0
votes
0
answers
482
views
What are the main differences between a covert timing channel and a covert storage channel?
I am trying to find the differences between a covert timing channel and a covert storage channel in terms of detectability, performance, features, and any other advantages and disadvantages.
Is ...
- 13
1
vote
1
answer
1k
views
Is there any method or tool other than nmap for the detection of an OS?
I wanted to know if there was any other way to detect the OS of a network (other than nmap) since nmap doesn't detect most versions of Windows 10 at all and identifies them as a different OS ...
- 119
2
votes
1
answer
1k
views
Can an ISP redirecting DNS traffic be detected by the end user?
If an ISP wants to gather profiles on users, or block certain websites, they can fairly easily redirect outgoing UDP traffic to port 53 to their own DNS servers.
How could this be detected by the end ...
- 21.6k
2
votes
4
answers
346
views
Ransomware aversion and identification techniques
I don't think there's a need to go into the background here, but identification of the process may be better explored.
From a developer pov, at a high level, the files are modified, by virtue of the ...
- 181
2
votes
1
answer
209
views
How can I as middleman verify whether a phishing site is valid if the scam listens only on the referrer link and blocks any other access methods?
How can I as a trusted user of a middleman company (such as PhishTank) verify whether a phishing site is valid if the scam listens only on a unique referrer link(randomly created) and is blocking any ...
- 431
-1
votes
1
answer
210
views
Does the term "malware signature" always refer to a pattern of bytes? [duplicate]
I know that traditionally a malware signature is a pattern of bytes in a program. While reading Joxean Koret and Elias Bachaalany's "Antivirus Hacker's Handbook" I saw that the authors categorized the ...
- 355
0
votes
1
answer
1k
views
Yara condition count operator with wildcard [closed]
I have a yara rule that looks for multiple strings in a file and fires if the count is greater than 3. But how would I change the condition statement to only fire if greater than 3 but less than 5?
...
- 143
1
vote
1
answer
841
views
What is "rule-based" analysis in malware detection?
I've read a few articles that describe the heuristic detection used by AVs as being either "weight-based" or "rule-based". The weight-based aspect seems to make sense, but I don't understand what "...
- 355
1
vote
0
answers
275
views
Snort rules to detect metasploit's trojan [duplicate]
I'm currently working on Snort and I'm trying to detect meterpreter sessions in reverse TCP or HTTPS, a Trojan ...
Does anyone know snort rules in order to detect this? Despite my research, I found ...
- 11
0
votes
0
answers
153
views
Antivirus and it's role in detecting payload execution?
My first question is this:
1) Antivirus software works using signature based detection. Signature based detection evaluates items (maybe not the right word?) based upon a big database of known threats....
0
votes
1
answer
359
views
What are the heuristic detection techniques most often used in modern AVs? [closed]
Whenever I read books or academic papers and the subject of heuristic malware detection is brought up they always say the same thing: "it can be either static or dynamic", "it may use emulation", "may ...
- 15
2
votes
1
answer
2k
views
What is an Albert sensor?
Recent news articles have started to talk about government networks deploying "Albert sensors" (e.g., this article). What is an Albert sensor? And how effective is it?
Going purely from context, it ...
- 100k
0
votes
2
answers
2k
views
Can my father's smartphone be compromised?
My father told me that he allowed the installation of apps from unknown sources when he was asked to do it to go further with something (he said that he doesn't remember when or what he was doing).
...
- 768
3
votes
2
answers
285
views
Why malwares need to be light
I am learning about how malwares work and I read that a lot of them are written in assembly or C to keep the binary size as small as possible.
In an example C++ source code, authors decided to remain ...
- 31
0
votes
1
answer
7k
views
Snort rule for syn flood attacks - Limiting number of alerts
So I have a snort rule that detects syn flood attacks that looks like this:
alert tcp any any -> $HOME_NET 80 (msg:”SYN Flood - SSH"; flags:S;
flow: stateless; detection_filter: track by_dst, ...
- 1