Questions tagged [detection]

Detection is the act of discovering and/or determining the existence, presence, or fact of something.

Filter by
Sorted by
Tagged with
0
votes
1answer
1k views

Snort rule for syn flood attacks - Limiting number of alerts

So I have a snort rule that detects syn flood attacks that looks like this: alert tcp any any -> $HOME_NET 80 (msg:”SYN Flood - SSH"; flags:S; flow: stateless; detection_filter: track by_dst, ...
1
vote
1answer
83 views

Is there any method or tool other than nmap for the detection of an OS?

I wanted to know if there was any other way to detect the OS of a network (other than nmap) since nmap doesn't detect most versions of Windows 10 at all and identifies them as a different OS ...
6
votes
2answers
1k views

mysql security logging

Is there any logging available that logs mysql connection attempts to the port, login attempts, and times succeeded with username, IP address and date time? Im trying to detect brute force attempts. ...
1
vote
4answers
192 views

Ransomware aversion and identification techniques

I don't think there's a need to go into the background here, but identification of the process may be better explored. From a developer pov, at a high level, the files are modified, by virtue of the ...
2
votes
1answer
62 views

Can an ISP redirecting DNS traffic be detected by the end user?

If an ISP wants to gather profiles on users, or block certain websites, they can fairly easily redirect outgoing UDP traffic to port 53 to their own DNS servers. How could this be detected by the end ...
2
votes
1answer
95 views

How can I as middleman verify whether a phishing site is valid if the scam listens only on the referrer link and blocks any other access methods?

How can I as a trusted user of a middleman company (such as PhishTank) verify whether a phishing site is valid if the scam listens only on a unique referrer link(randomly created) and is blocking any ...
7
votes
1answer
3k views

Is it possible to detect DPI (Deep Packet Inspection)?

If one suspects one's packets are subject to DPI, how can it be detected?
-1
votes
1answer
50 views

Does the term “malware signature” always refer to a pattern of bytes? [duplicate]

I know that traditionally a malware signature is a pattern of bytes in a program. While reading Joxean Koret and Elias Bachaalany's "Antivirus Hacker's Handbook" I saw that the authors categorized the ...
0
votes
1answer
106 views

What is “rule-based” analysis in malware detection?

I've read a few articles that describe the heuristic detection used by AVs as being either "weight-based" or "rule-based". The weight-based aspect seems to make sense, but I don't understand what "...
0
votes
1answer
73 views

Yara condition count operator with wildcard [closed]

I have a yara rule that looks for multiple strings in a file and fires if the count is greater than 3. But how would I change the condition statement to only fire if greater than 3 but less than 5? ...
6
votes
4answers
5k views

Is plausible deniability actually feasible for encrypted volumes/disks?

Based on Is it possible to tell if hard drive is encrypted?, is it actually possible to hide a volume in practice? According to this answer TrueCrypt is the only well-known disk encryption software ...
1
vote
2answers
871 views

Combine SNORT detection and log with active response OSSEC

As far as i know, NIDS implemented in Network layer and HIDS in Host-based layer, Is it possible for NIDS( for example: Snort or suricata ) log that will included in HIDS(for example: OSSEC) log too ? ...
5
votes
3answers
11k views

Finding a backdoor on a server?

Let's say I hire someone (freelance), for IT work on an Ubuntu server. The server has a good firewall, I run clamav, chkrootkit & rkhunter scans weekly, and I try to keep good practices. The ...
0
votes
0answers
27 views

Snort rules to detect metasploit's trojan [duplicate]

I'm currently working on Snort and I'm trying to detect meterpreter sessions in reverse TCP or HTTPS, a Trojan ... Does anyone know snort rules in order to detect this? Despite my research, I found ...
0
votes
0answers
47 views

Are all “behavioral detection” of malware a form of heuristic detection? [duplicate]

A lot of articles I read seem to lump behavioral detection together with heuristic detection. From what I know, one of the defining features of heuristic detection is that it can be used to detect new ...
-3
votes
2answers
157 views

Impossible VM-detection countermeasures [closed]

Are there any vm-detection techniques (of malware) which are impossible to mitigate in your vm? If yes, which?
1
vote
2answers
312 views

Datasets dedicated for SIEM systems

I am looking for data sets published by researchers or freelancers which can be used for the purpose of SIEM testing and evaluations. The goal is to test the classification (and later correlation) for ...
0
votes
0answers
47 views

Antivirus and it's role in detecting payload execution?

My first question is this: 1) Antivirus software works using signature based detection. Signature based detection evaluates items (maybe not the right word?) based upon a big database of known threats....
1
vote
1answer
824 views

Can my father's smartphone be compromised?

My father said to me that he allowed installation of apps from unknown sources when he was asked to do it to go further with something (he said that don't remember when or what he was doing). In ...
3
votes
3answers
7k views

How effective is Windows Task Manager at identifying keyloggers?

I just hit upon an idea I have used in the past to distinguish between two instances of the same program, one of which was hung. While Task Manager is open and visible and sorted by CPU usage, I pick ...
0
votes
0answers
54 views

Detecting cracked Themida packed malware

I'm working in a large SOC and my manager has tasked me with finding some way to provide coverage for Themida packed malware samples. As alluring as it is to suggest just blacklisting all Themida ...
0
votes
1answer
115 views

What are the heuristic detection techniques most often used in modern AVs? [closed]

Whenever I read books or academic papers and the subject of heuristic malware detection is brought up they always say the same thing: "it can be either static or dynamic", "it may use emulation", "may ...
4
votes
2answers
200 views

Why malwares need to be light

I am learning about how malwares work and I read that a lot of them are written in assembly or C to keep the binary size as small as possible. In an example C++ source code, authors decided to remain ...
2
votes
1answer
396 views

What is an Albert sensor?

Recent news articles have started to talk about government networks deploying "Albert sensors" (e.g., this article). What is an Albert sensor? And how effective is it? Going purely from context, it ...
0
votes
0answers
40 views

Assess anti-malware detection techniques

Are there any known, conventional, ways of assessing the types of detection techniques an endpoint security product might employ? I know AV-Test and AV-Comparatives exist to test the effectiveness of ...
148
votes
19answers
40k views

Has it been mathematically proven that antivirus can't detect all viruses?

What analysis was Bruce Schneier referencing when he wrote: Viruses have no “cure.” It’s been mathematically proven that it is always possible to write a virus that any existing antivirus program ...
1
vote
2answers
7k views

using msfvenom to encode an exe file without any payload, like oldy msfencode (packing)

Doing some research about packing and such, I went on the possibility to use the old msfencode to generate a packed exe. However, msfencode is not updated anymore (still found on kali however), and I ...
1
vote
1answer
71 views

Can using simultaneous intrusion detection systems (IDS) create conflicts?

Can simultaneously using 2 or more intrusion detection systems (IDS) on the same computer or network create conflicts ? Talking about tools (as examples) such as but not limited to: tripwire, bro, ...
2
votes
1answer
158 views

What features would you use to detect a backdoor or a bot installation?

I was reading a document about logging and analysis. The document talks about statistical analysis and machine learning techniques to detect some attack scenarios. For instance, If you want to detect ...
36
votes
6answers
18k views

Is it possible to detect 100% of SQLi with a simple regex?

I'm wondering if it is possible to detect 100% of the possible SQLi attacks using a simple regex. In other words, using very simple PHP code as an example: if (preg_match("/select/i", $input)) { ...
7
votes
4answers
11k views

Possible to detect packed executable?

A packer is a way of obfuscating an executable program, i.e., transforming so the result is still executable and has the same effect when run, but looks different (so it won't be detected by static ...
2
votes
2answers
249 views

Should you consider a system compromised if someone could have physically accessed it, but you have no evidence they did?

An old adage is that if an adversary physically accessed your system, you should consider it compromised. My question is, what if they could have, but you have no evidence they did? For example, let ...
2
votes
4answers
2k views

Detecting malware hidden in P2P traffic

Consider a network situation involving (only) Peer to Peer traffic in medium sized network. For the sake of convenience, a simple P2P application like DC++ may be assumed, although I am aiming at a ...
12
votes
2answers
32k views

How can I detect which background application is using the camera, microphone or GPRS?

I want to learn how to write and Android application that can detect a run time spy application. In this instance, a "spy application" is a background application that uses the camera, microphone and ...
0
votes
1answer
75 views

How can I detect an infection in a database?

Detecting infected files in a website or web application is very easy: you just need to compare the files with a clean backup or the original source (for example with diff) and that's it. However, ...
1
vote
0answers
46 views

What makes detection of optimized-away memory clearing non-trivial?

In this 35C3 talk, it is said that while it is possible to manually inspect whether a package optimizes away memset() that clears sensitive memory, doing it automatically would be challenging. ...
1
vote
1answer
108 views

100% detectable backdoor attacks on network

Every article I have read on backdoor attack prevention says pretty much this: Protecting against them may be difficult. I am tired of reading how it can be ~difficult~ to protect against. ...
0
votes
0answers
156 views

Heuristics-based vs behavioral malware detection

I'm working on my thesis and I have a couple questions about differences between heuristics-based and behavioral malware detection. Does heuristics-based detection rely only on statically examining ...
0
votes
1answer
63 views

Does Real-time typing view in chats invades privacy? Are there any detection and prevention methods?

When a customer talks with a representative of a company in a chat on a web-page, it is possible that they are actually sending every keystroke to their server before you hit the enter or click the ...
1
vote
1answer
63 views

Detecting if an agent is listening to specific messages

Is there a way to detect if an agent Z is listening to (and acting on) messages from Y? I can observe the messages that Y sends and the actions that Z takes, but I know Z is also listening (and acting ...
1
vote
1answer
318 views

Error detection capability of SHA-256

If we use SHA-256 checksum to detect corruptions to a file, what is its capability in terms of missed errors? For example, reading the page about error correction and detection here, under the ...
0
votes
3answers
3k views

If I connect to a website using a cellular network, and change the sim card and connect again with the same phone, will they find its the same phone?

I read on a blog that when you connect to a website with your phone they track the model number id of the device, or something like it. I don't remember what its called. Even if you change your sim ...
1
vote
0answers
41 views

Is it possible that a usb drive manufactured 3 months ago can have data copied to it that shows the file last modified date before manufacturing date? [closed]

I have some data that needs to be handed to a friend. I don't want to give the original drive (drive-1), so I plan to purchase a drive (drive-copy) and copy data to it. The data copied will still show ...
6
votes
1answer
6k views

What is TTP hunting?

What is "TTP hunting" in terms of network security research? I came across this term, but do not know what this is . Tried to google it, but TTP seem to stand for many different things, but none of ...
64
votes
5answers
17k views

Can Beehive detect a Snowden-like actor?

In a seminar, one of the Authors of Beehive: Large-Scale Log Analysis for Detecting Suspicious Activity in Enterprise Networks said that this system can prevent actions like Snowden did. From their ...
8
votes
6answers
3k views

How could malware like Stuxnet be detected?

Stuxnet and others in this list of state-of-the-art Internet worms had certain features that they were very stealthy in leaking out the information they harvested. Thus it managed to go under the ...
0
votes
2answers
211 views

If a file on USB drive shows a certain “date modified” time in the windows explorer, can the correct added date/time be checked for the file?

If someone copied files from a drive-1 to usb-drive-2, then it seems the directories and files get the original modified time from drive-1 in some cases and in some cases not. Can it be checked if ...
0
votes
1answer
56 views

How can one make sure that some specific directories are fully deleted (without any record of their deletion) from a USB/flash drive?

It seems data resides in USB somewhere until it's completely overwritten. But is there a way to delete big directories 10-100GB or so without zero-filling the remaining space and only eradicating ...
5
votes
1answer
77 views

Can I use `lsof` to reliably determine which local process has connected to my open port?

Say I'm running a server application on 127.0.0.1:7646 and a local process (possibly owned by a different user) connects to it, I can run lsof -Fp -i TCP@127.0.0.1:7646 -i TCP@127.0.0.1:<...
0
votes
0answers
51 views

Detecting network attacks by processing individual or multiple network packets?

I am trying to create a tool that identifies network attacks using machine learning, something like a small intrusion detection system. I have collected benign traffic from the network and then ...