Questions tagged [detection]

Detection is the act of discovering and/or determining the existence, presence, or fact of something.

Filter by
Sorted by
Tagged with
0 votes
1 answer
65 views

Bypassing root detection qualify as a vulnerability?

I am working on security testing of an android application. There is a root detection in the Android application. objection, frida etc. It is possible to bypass this with ways. My main question is: ...
Exnovan's user avatar
  • 15
1 vote
1 answer
86 views

Understanding XDR Detection Methods

I'm interested in security and redteaming in particular, and as I'm learning about the subject I'm trying to find out what kind of things a blue team EDR/XDR solution will look for as part of its ...
Rajman's user avatar
  • 11
0 votes
1 answer
129 views

How does Windows Defender for Mac block applications and how can people evade the block?

I am using MS Defender for Mac to specify a list of unwanted applications on the managed devices in my company. I am concerned that some users try to evade the detection by altering the binaries of ...
Xenonite's user avatar
0 votes
1 answer
61 views

Any (opensource) tool that we can use to detect if our computers has been installed applications that have proxies services

Read something like this on reddit "someone can also be a regular user who does not read terms and conditions of apps that they install. Some apps might include code that will enable them to run ...
Maxfield's user avatar
  • 127
1 vote
0 answers
41 views

Effectiveness of USB flash testing software

So I've just had an SD card ruined & while it's not very expensive, I'd rather have it last me a much, much longer time. As a precaution going forward now, I'd like to be able to detect right away ...
Tempus Nomen's user avatar
1 vote
0 answers
47 views

Kusto to Osquery translator?

Osquery is a great open standard for collecting data from endpoints, using SQL syntax. Kusto is a new Microsoft language for collecting data from Windows endpoints, using syntax which is almost--but ...
user502's user avatar
  • 3,311
3 votes
2 answers
732 views

Has malware detected mitmproxy and similar tools used to intercept and analyze malicious traffic?

When trying to analyze malware, have there been cases where malware detected the use of mitmproxy and ceased operation? If that has happened, would it be a good idea to be constantly using a proxy as ...
Sir Muffington's user avatar
0 votes
0 answers
46 views

Windows 10 Cybersecurity on Stand-Alone Computer

I have been asked to investigate what capabilities exist within Windows 10 where the environment for this system is isolated. I believe it would not be able to benefit from an enterprise security ...
Jim's user avatar
  • 255
0 votes
1 answer
113 views

Has there ever been a case of dangerous industrial malware, which would destroy motherboards and similar PC components and how to protect [duplicate]

I heard many years ago from word of mouth that this kind of malware exists, which could for example blow up capacitors in your PC. Has such malware or something even remotely similar ever existed? ...
Sir Muffington's user avatar
1 vote
3 answers
632 views

How can I have my process detect if antivirus injected a module or DLL to it?

I am writing an installer process (.exe). My installer deploys different components. It will add registry entries, copy files, copy files over the network, remote execute, remote PowerShell, local ...
ilansch's user avatar
  • 113
0 votes
1 answer
346 views

Misuse vs anomaly detection alerts

Adam always reads his e-mails on Sundays around 5 pm. This Saturday, at 11 am, he accessed his inbox. Which will generate a false positive? Source slide 10/41 Misuse-based IDS or anomaly-based IDS? ...
pazzah's user avatar
  • 1
0 votes
1 answer
106 views

Remote detection of a trojan - how can it be done?

In this blog post CyberCube claim: CyberCube observed a malware infection on Colonial Pipeline’s network named “trojan.win32.razy.gen” I'm really curious to know how this could be done from outside ...
John C's user avatar
  • 11
0 votes
4 answers
206 views

Mouse moving while unattended, how can I check for intrusions

A few hours ago, I spotted my unattended mouse moving and seeming to click on tabs. I promptly rebooted my system and removed Teamviewer (it's the only remote connection app that I have installed), ...
Olumide's user avatar
  • 101
0 votes
0 answers
116 views

Is every packet of a hostile network flow hostile?

We are building a packet based anomaly detection system and I'm trying to find labeled packets. Such dataset doesn't exist based on my search, but I can find labeled flows. Can we say that every ...
user128576's user avatar
1 vote
0 answers
91 views

watch-video.net malware and preventing these types of infections at the network level [closed]

How does a computer get infected with watch-video.net malware, and why aren't popular tools like windows defender or malwarebytes able to detect and remove it? Is there a practical way to prevent ...
jtlindsey's user avatar
  • 225
1 vote
1 answer
265 views

Is it possible to completely obfuscate proxy servers?

Stripe's fraud detection documentation claims it has Proxy Detection When I search for how it might be detecting traffic from proxies, I see this great answer, which show how to detect that traffic. ...
stevec's user avatar
  • 1,250
55 votes
6 answers
20k views

If malware does not run in a VM why not make everything a VM?

There is a lot of malware that can detect whether it is running inside a VM or sandboxed environment and if such environment is detected it can conceal it self and not execute. So why not make ...
Marcus's user avatar
  • 1,165
0 votes
1 answer
494 views

Is there any advantages in using a Network Intrusion Detection System, when already having a EDR solution?

Does implementing a Network Intrusion Detection System (NIDS) give you any advantages over an Endpoint Detection and Response (EDR) solution? I've been trying to do research on this, but are ...
Grenair's user avatar
0 votes
1 answer
237 views

How does one detect and deter golden SAML attacks?

How does one defend, detect and deter golden SAML attacks?
Nathan Aw's user avatar
3 votes
0 answers
191 views

Can the glue of glitter-hot-glue sticks be used to provide evidence of electronics-hardware tampering?

I've been researching low-cost, yet strong, tamper-evident mechanisms, and purchased some low-cost glitter-hot-glue sticks as part of this research. The Amazon page advertising the sticks, seems to ...
Mark Fernandes's user avatar
0 votes
1 answer
2k views

Is it safe to use an executable if only unknown antiviruses detected something?

Recently I downloaded Open Shell application and checked it via VirusTotal. Most famous antiviruses like Bitdefender, Nrothon, Kaspersky found nothing. But some of antiviruses thing there are some bad ...
R S's user avatar
  • 225
1 vote
1 answer
312 views

Reverse shell with python client side becomes detectable after converting with pyinstaller as exe file

When converting the reverse shell client.py python file to exe with pyinstaller it becomes detectable as a trojan on virustotal.com with most antivirus. Here is my client file: import os, socket, ...
Pro Girl's user avatar
  • 111
1 vote
1 answer
137 views

Is it possible to ensure detection and logging of all attempts to copy data out of a system?

I am cross-posting this question from Serverfault, because I am in doubt where it fits best. Say I have a server set up for processing sensitive data. The few authorised users of the system are ...
Thomas Arildsen's user avatar
1 vote
1 answer
108 views

Are there services to detect data breaches?

There have been quite a lot of data breaches in the past and I wonder how the companies got to know them. Were they only finding it in the news? Did individuals inform them? What about small data ...
Martin Thoma's user avatar
  • 3,914
0 votes
1 answer
167 views

Insider threats vs. insider attacks

I understand that a threat is a possible security violation that might exploit the vulnerability of a system, and a attack is an action on a system that harms the organisation in some way. Therefore, ...
Ylvetal's user avatar
1 vote
1 answer
197 views

Is the perfect MITM attack possible?

Let's imagine a data link layer level MITM attack. Is it possible to fulfill all of the following points? you completely hide your identity by forging your own MAC address you create malformed ...
user avatar
0 votes
2 answers
140 views

How can I determine if a malware sample is morphic? (polymorphic, metamorphic, etc)

I want to do a malware test that specifically uses recent morphic malware samples (polymorphic, metamorphic, etc). There are a couple of good sources I can pull samples from, but I need to know if ...
Erelbrin's user avatar
3 votes
3 answers
303 views

Logging connections to hardcoded IP addresses

On a Windows system, I'm able to get a good idea of most outgoing traffic by enabling DNS query logging, but I am missing those connections that are made straight to hardcoded IP addresses. What would ...
John Blatz's user avatar
  • 1,001
2 votes
0 answers
131 views

Deciding between MDR solutions offering endpoint agents with or without an additional network appliance?

There are a number of different Managed Security Service Providers (MSSPs) offering managed detection and response services. They tend to use what is called an endpoint agent, while only some use a ...
Saturn_V's user avatar
0 votes
1 answer
255 views

How to check big video file if can't check it entirely?

There size limit on VirusTotal, some videos are very big. What if cut off part from the video and send part of it. Is it possible? What part of it, where malware can be?
R S's user avatar
  • 225
0 votes
0 answers
410 views

What are the main differences between a covert timing channel and a covert storage channel?

I am trying to find the differences between a covert timing channel and a covert storage channel in terms of detectability, performance, features, and any other advantages and disadvantages. Is ...
Nick's user avatar
  • 13
1 vote
1 answer
764 views

Is there any method or tool other than nmap for the detection of an OS?

I wanted to know if there was any other way to detect the OS of a network (other than nmap) since nmap doesn't detect most versions of Windows 10 at all and identifies them as a different OS ...
DragonlordDrake's user avatar
2 votes
1 answer
1k views

Can an ISP redirecting DNS traffic be detected by the end user?

If an ISP wants to gather profiles on users, or block certain websites, they can fairly easily redirect outgoing UDP traffic to port 53 to their own DNS servers. How could this be detected by the end ...
Steve Sether's user avatar
  • 21.6k
2 votes
4 answers
317 views

Ransomware aversion and identification techniques

I don't think there's a need to go into the background here, but identification of the process may be better explored. From a developer pov, at a high level, the files are modified, by virtue of the ...
Pogrindis's user avatar
  • 181
2 votes
1 answer
183 views

How can I as middleman verify whether a phishing site is valid if the scam listens only on the referrer link and blocks any other access methods?

How can I as a trusted user of a middleman company (such as PhishTank) verify whether a phishing site is valid if the scam listens only on a unique referrer link(randomly created) and is blocking any ...
tungsten's user avatar
  • 421
-1 votes
1 answer
183 views

Does the term "malware signature" always refer to a pattern of bytes? [duplicate]

I know that traditionally a malware signature is a pattern of bytes in a program. While reading Joxean Koret and Elias Bachaalany's "Antivirus Hacker's Handbook" I saw that the authors categorized the ...
chillsauce's user avatar
0 votes
1 answer
1k views

Yara condition count operator with wildcard [closed]

I have a yara rule that looks for multiple strings in a file and fires if the count is greater than 3. But how would I change the condition statement to only fire if greater than 3 but less than 5? ...
bigC5012's user avatar
  • 143
1 vote
1 answer
695 views

What is "rule-based" analysis in malware detection?

I've read a few articles that describe the heuristic detection used by AVs as being either "weight-based" or "rule-based". The weight-based aspect seems to make sense, but I don't understand what "...
chillsauce's user avatar
1 vote
0 answers
266 views

Snort rules to detect metasploit's trojan [duplicate]

I'm currently working on Snort and I'm trying to detect meterpreter sessions in reverse TCP or HTTPS, a Trojan ... Does anyone know snort rules in order to detect this? Despite my research, I found ...
Jérémy Papin's user avatar
0 votes
0 answers
123 views

Antivirus and it's role in detecting payload execution?

My first question is this: 1) Antivirus software works using signature based detection. Signature based detection evaluates items (maybe not the right word?) based upon a big database of known threats....
Digipanacea's user avatar
0 votes
1 answer
311 views

What are the heuristic detection techniques most often used in modern AVs? [closed]

Whenever I read books or academic papers and the subject of heuristic malware detection is brought up they always say the same thing: "it can be either static or dynamic", "it may use emulation", "may ...
magnetlion's user avatar
2 votes
1 answer
2k views

What is an Albert sensor?

Recent news articles have started to talk about government networks deploying "Albert sensors" (e.g., this article). What is an Albert sensor? And how effective is it? Going purely from context, it ...
D.W.'s user avatar
  • 99.3k
0 votes
2 answers
2k views

Can my father's smartphone be compromised?

My father told me that he allowed the installation of apps from unknown sources when he was asked to do it to go further with something (he said that he doesn't remember when or what he was doing). ...
Mycroft's user avatar
  • 758
4 votes
2 answers
255 views

Why malwares need to be light

I am learning about how malwares work and I read that a lot of them are written in assembly or C to keep the binary size as small as possible. In an example C++ source code, authors decided to remain ...
protoneight's user avatar
0 votes
1 answer
6k views

Snort rule for syn flood attacks - Limiting number of alerts

So I have a snort rule that detects syn flood attacks that looks like this: alert tcp any any -> $HOME_NET 80 (msg:”SYN Flood - SSH"; flags:S; flow: stateless; detection_filter: track by_dst, ...
Liam's user avatar
  • 1
2 votes
1 answer
382 views

What features would you use to detect a backdoor or a bot installation?

I was reading a document about logging and analysis. The document talks about statistical analysis and machine learning techniques to detect some attack scenarios. For instance, If you want to detect ...
U. User's user avatar
  • 180
43 votes
7 answers
38k views

Is it possible to detect 100% of SQLi with a simple regex?

I'm wondering if it is possible to detect 100% of the possible SQLi attacks using a simple regex. In other words, using very simple PHP code as an example: if (preg_match("/select/i", $input)) { ...
reed's user avatar
  • 15.7k
153 votes
19 answers
43k views

Has it been mathematically proven that antivirus can't detect all viruses?

What analysis was Bruce Schneier referencing when he wrote: Viruses have no “cure.” It’s been mathematically proven that it is always possible to write a virus that any existing antivirus program ...
Cate's user avatar
  • 1,245
0 votes
1 answer
337 views

How can I detect an infection in a database?

Detecting infected files in a website or web application is very easy: you just need to compare the files with a clean backup or the original source (for example with diff) and that's it. However, ...
reed's user avatar
  • 15.7k
1 vote
0 answers
94 views

What makes detection of optimized-away memory clearing non-trivial?

In this 35C3 talk, it is said that while it is possible to manually inspect whether a package optimizes away memset() that clears sensitive memory, doing it automatically would be challenging. ...
d33tah's user avatar
  • 6,534

1
2 3 4 5