Questions tagged [detection]

Detection is the act of discovering and/or determining the existence, presence, or fact of something.

Filter by
Sorted by
Tagged with
3 votes
2 answers
454 views

Has malware detected mitmproxy and similar tools used to intercept and analyze malicious traffic?

When trying to analyze malware, have there been cases where malware detected the use of mitmproxy and ceased operation? If that has happened, would it be a good idea to be constantly using a proxy as ...
user avatar
0 votes
0 answers
38 views

Windows 10 Cybersecurity on Stand-Alone Computer

I have been asked to investigate what capabilities exist within Windows 10 where the environment for this system is isolated. I believe it would not be able to benefit from an enterprise security ...
user avatar
  • 255
0 votes
1 answer
98 views

Has there ever been a case of dangerous industrial malware, which would destroy motherboards and similar PC components and how to protect [duplicate]

I heard many years ago from word of mouth that this kind of malware exists, which could for example blow up capacitors in your PC. Has such malware or something even remotely similar ever existed? ...
user avatar
1 vote
3 answers
188 views

How can I have my process detect if antivirus injected a module or DLL to it?

I am writing an installer process (.exe). My installer deploys different components. It will add registry entries, copy files, copy files over the network, remote execute, remote PowerShell, local ...
user avatar
  • 113
0 votes
1 answer
170 views

Misuse vs anomaly detection alerts

Adam always reads his e-mails on Sundays around 5 pm. This Saturday, at 11 am, he accessed his inbox. Which will generate a false positive? Source slide 10/41 Misuse-based IDS or anomaly-based IDS? ...
user avatar
  • 1
0 votes
1 answer
100 views

Remote detection of a trojan - how can it be done?

In this blog post CyberCube claim: CyberCube observed a malware infection on Colonial Pipeline’s network named “trojan.win32.razy.gen” I'm really curious to know how this could be done from outside ...
user avatar
  • 11
0 votes
4 answers
197 views

Mouse moving while unattended, how can I check for intrusions

A few hours ago, I spotted my unattended mouse moving and seeming to click on tabs. I promptly rebooted my system and removed Teamviewer (it's the only remote connection app that I have installed), ...
user avatar
  • 101
0 votes
0 answers
87 views

Is every packet of a hostile network flow hostile?

We are building a packet based anomaly detection system and I'm trying to find labeled packets. Such dataset doesn't exist based on my search, but I can find labeled flows. Can we say that every ...
user avatar
1 vote
0 answers
80 views

watch-video.net malware and preventing these types of infections at the network level [closed]

How does a computer get infected with watch-video.net malware, and why aren't popular tools like windows defender or malwarebytes able to detect and remove it? Is there a practical way to prevent ...
user avatar
  • 225
1 vote
1 answer
150 views

Is it possible to completely obfuscate proxy servers?

Stripe's fraud detection documentation claims it has Proxy Detection When I search for how it might be detecting traffic from proxies, I see this great answer, which show how to detect that traffic. ...
user avatar
  • 1,214
54 votes
6 answers
20k views

If malware does not run in a VM why not make everything a VM?

There is a lot of malware that can detect whether it is running inside a VM or sandboxed environment and if such environment is detected it can conceal it self and not execute. So why not make ...
user avatar
  • 1,145
0 votes
1 answer
298 views

Is there any advantages in using a Network Intrusion Detection System, when already having a EDR solution?

Does implementing a Network Intrusion Detection System (NIDS) give you any advantages over an Endpoint Detection and Response (EDR) solution? I've been trying to do research on this, but are ...
user avatar
0 votes
1 answer
168 views

How does one detect and deter golden SAML attacks?

How does one defend, detect and deter golden SAML attacks?
user avatar
3 votes
0 answers
167 views

Can the glue of glitter-hot-glue sticks be used to provide evidence of electronics-hardware tampering?

I've been researching low-cost, yet strong, tamper-evident mechanisms, and purchased some low-cost glitter-hot-glue sticks as part of this research. The Amazon page advertising the sticks, seems to ...
user avatar
0 votes
1 answer
2k views

Is it safe to use an executable if only unknown antiviruses detected something?

Recently I downloaded Open Shell application and checked it via VirusTotal. Most famous antiviruses like Bitdefender, Nrothon, Kaspersky found nothing. But some of antiviruses thing there are some bad ...
user avatar
  • 225
1 vote
1 answer
189 views

Reverse shell with python client side becomes detectable after converting with pyinstaller as exe file

When converting the reverse shell client.py python file to exe with pyinstaller it becomes detectable as a trojan on virustotal.com with most antivirus. Here is my client file: import os, socket, ...
user avatar
  • 111
1 vote
1 answer
116 views

Is it possible to ensure detection and logging of all attempts to copy data out of a system?

I am cross-posting this question from Serverfault, because I am in doubt where it fits best. Say I have a server set up for processing sensitive data. The few authorised users of the system are ...
user avatar
1 vote
1 answer
99 views

Are there services to detect data breaches?

There have been quite a lot of data breaches in the past and I wonder how the companies got to know them. Were they only finding it in the news? Did individuals inform them? What about small data ...
user avatar
  • 3,882
0 votes
1 answer
148 views

Insider threats vs. insider attacks

I understand that a threat is a possible security violation that might exploit the vulnerability of a system, and a attack is an action on a system that harms the organisation in some way. Therefore, ...
user avatar
1 vote
1 answer
164 views

Is the perfect MITM attack possible?

Let's imagine a data link layer level MITM attack. Is it possible to fulfill all of the following points? you completely hide your identity by forging your own MAC address you create malformed ...
user avatar
0 votes
2 answers
130 views

How can I determine if a malware sample is morphic? (polymorphic, metamorphic, etc)

I want to do a malware test that specifically uses recent morphic malware samples (polymorphic, metamorphic, etc). There are a couple of good sources I can pull samples from, but I need to know if ...
user avatar
3 votes
3 answers
226 views

Logging connections to hardcoded IP addresses

On a Windows system, I'm able to get a good idea of most outgoing traffic by enabling DNS query logging, but I am missing those connections that are made straight to hardcoded IP addresses. What would ...
user avatar
2 votes
0 answers
122 views

Deciding between MDR solutions offering endpoint agents with or without an additional network appliance?

There are a number of different Managed Security Service Providers (MSSPs) offering managed detection and response services. They tend to use what is called an endpoint agent, while only some use a ...
user avatar
0 votes
1 answer
141 views

How to check big video file if can't check it entirely?

There size limit on VirusTotal, some videos are very big. What if cut off part from the video and send part of it. Is it possible? What part of it, where malware can be?
user avatar
  • 225
0 votes
0 answers
277 views

What are the main differences between a covert timing channel and a covert storage channel?

I am trying to find the differences between a covert timing channel and a covert storage channel in terms of detectability, performance, features, and any other advantages and disadvantages. Is ...
user avatar
  • 13
1 vote
1 answer
338 views

Is there any method or tool other than nmap for the detection of an OS?

I wanted to know if there was any other way to detect the OS of a network (other than nmap) since nmap doesn't detect most versions of Windows 10 at all and identifies them as a different OS ...
user avatar
2 votes
1 answer
751 views

Can an ISP redirecting DNS traffic be detected by the end user?

If an ISP wants to gather profiles on users, or block certain websites, they can fairly easily redirect outgoing UDP traffic to port 53 to their own DNS servers. How could this be detected by the end ...
user avatar
  • 21.5k
2 votes
4 answers
306 views

Ransomware aversion and identification techniques

I don't think there's a need to go into the background here, but identification of the process may be better explored. From a developer pov, at a high level, the files are modified, by virtue of the ...
user avatar
  • 181
2 votes
1 answer
169 views

How can I as middleman verify whether a phishing site is valid if the scam listens only on the referrer link and blocks any other access methods?

How can I as a trusted user of a middleman company (such as PhishTank) verify whether a phishing site is valid if the scam listens only on a unique referrer link(randomly created) and is blocking any ...
user avatar
  • 432
-1 votes
1 answer
150 views

Does the term "malware signature" always refer to a pattern of bytes? [duplicate]

I know that traditionally a malware signature is a pattern of bytes in a program. While reading Joxean Koret and Elias Bachaalany's "Antivirus Hacker's Handbook" I saw that the authors categorized the ...
user avatar
0 votes
1 answer
739 views

Yara condition count operator with wildcard [closed]

I have a yara rule that looks for multiple strings in a file and fires if the count is greater than 3. But how would I change the condition statement to only fire if greater than 3 but less than 5? ...
user avatar
  • 143
1 vote
1 answer
571 views

What is "rule-based" analysis in malware detection?

I've read a few articles that describe the heuristic detection used by AVs as being either "weight-based" or "rule-based". The weight-based aspect seems to make sense, but I don't understand what "...
user avatar
1 vote
0 answers
264 views

Snort rules to detect metasploit's trojan [duplicate]

I'm currently working on Snort and I'm trying to detect meterpreter sessions in reverse TCP or HTTPS, a Trojan ... Does anyone know snort rules in order to detect this? Despite my research, I found ...
user avatar
0 votes
0 answers
117 views

Antivirus and it's role in detecting payload execution?

My first question is this: 1) Antivirus software works using signature based detection. Signature based detection evaluates items (maybe not the right word?) based upon a big database of known threats....
user avatar
0 votes
1 answer
280 views

What are the heuristic detection techniques most often used in modern AVs? [closed]

Whenever I read books or academic papers and the subject of heuristic malware detection is brought up they always say the same thing: "it can be either static or dynamic", "it may use emulation", "may ...
user avatar
2 votes
1 answer
1k views

What is an Albert sensor?

Recent news articles have started to talk about government networks deploying "Albert sensors" (e.g., this article). What is an Albert sensor? And how effective is it? Going purely from context, it ...
user avatar
  • 98.3k
0 votes
2 answers
2k views

Can my father's smartphone be compromised?

My father told me that he allowed the installation of apps from unknown sources when he was asked to do it to go further with something (he said that he doesn't remember when or what he was doing). ...
user avatar
  • 747
4 votes
2 answers
247 views

Why malwares need to be light

I am learning about how malwares work and I read that a lot of them are written in assembly or C to keep the binary size as small as possible. In an example C++ source code, authors decided to remain ...
user avatar
0 votes
1 answer
5k views

Snort rule for syn flood attacks - Limiting number of alerts

So I have a snort rule that detects syn flood attacks that looks like this: alert tcp any any -> $HOME_NET 80 (msg:”SYN Flood - SSH"; flags:S; flow: stateless; detection_filter: track by_dst, ...
user avatar
  • 1
2 votes
1 answer
325 views

What features would you use to detect a backdoor or a bot installation?

I was reading a document about logging and analysis. The document talks about statistical analysis and machine learning techniques to detect some attack scenarios. For instance, If you want to detect ...
user avatar
  • 170
39 votes
7 answers
32k views

Is it possible to detect 100% of SQLi with a simple regex?

I'm wondering if it is possible to detect 100% of the possible SQLi attacks using a simple regex. In other words, using very simple PHP code as an example: if (preg_match("/select/i", $input)) { ...
user avatar
  • 15.3k
152 votes
19 answers
42k views

Has it been mathematically proven that antivirus can't detect all viruses?

What analysis was Bruce Schneier referencing when he wrote: Viruses have no “cure.” It’s been mathematically proven that it is always possible to write a virus that any existing antivirus program ...
user avatar
  • 1,235
0 votes
1 answer
193 views

How can I detect an infection in a database?

Detecting infected files in a website or web application is very easy: you just need to compare the files with a clean backup or the original source (for example with diff) and that's it. However, ...
user avatar
  • 15.3k
1 vote
0 answers
91 views

What makes detection of optimized-away memory clearing non-trivial?

In this 35C3 talk, it is said that while it is possible to manually inspect whether a package optimizes away memset() that clears sensitive memory, doing it automatically would be challenging. ...
user avatar
  • 6,514
2 votes
2 answers
324 views

Should you consider a system compromised if someone could have physically accessed it, but you have no evidence they did?

An old adage is that if an adversary physically accessed your system, you should consider it compromised. My question is, what if they could have, but you have no evidence they did? For example, let ...
user avatar
  • 2,937
1 vote
1 answer
227 views

100% detectable backdoor attacks on network

Every article I have read on backdoor attack prevention says pretty much this: Protecting against them may be difficult. I am tired of reading how it can be ~difficult~ to protect against. ...
user avatar
  • 558
0 votes
0 answers
299 views

Heuristics-based vs behavioral malware detection

I'm working on my thesis and I have a couple questions about differences between heuristics-based and behavioral malware detection. Does heuristics-based detection rely only on statically examining ...
user avatar
  • 131
0 votes
1 answer
189 views

Does Real-time typing view in chats invades privacy? Are there any detection and prevention methods?

When a customer talks with a representative of a company in a chat on a web-page, it is possible that they are actually sending every keystroke to their server before you hit the enter or click the ...
user avatar
  • 5,389
1 vote
1 answer
101 views

Detecting if an agent is listening to specific messages

Is there a way to detect if an agent Z is listening to (and acting on) messages from Y? I can observe the messages that Y sends and the actions that Z takes, but I know Z is also listening (and acting ...
user avatar
  • 111
2 votes
1 answer
1k views

Error detection capability of SHA-256

If we use SHA-256 checksum to detect corruptions to a file, what is its capability in terms of missed errors? For example, reading the page about error correction and detection here, under the ...
user avatar
  • 165

1
2 3 4 5