Questions tagged [ids]
Intrusion Detection System, a system for detecting and alerting based on behavior.
0
votes
0answers
29 views
What is recommended size for Suricata Ruleset (i.e., Signatures)? [on hold]
What is the recommended size for Suricata ruleset(i.e., Signatures)?
Kindly answer with some references, reason.
0
votes
1answer
65 views
Advice to detect suspicious activities on network
A private network (about 150 PCs) is connected to the internet through an edge router. According to the net admin, his network is scanned from the outside, at the edge router. I don’t have any more ...
0
votes
0answers
16 views
How to run a snort rule over PCAP file in Windows? [duplicate]
I have a PCAP file from CICIDS, and what I'd like to know is how can I apply the Snortrule in Windows? I've not written any custom rules myself but want to run the rules already available. For now, ...
0
votes
0answers
122 views
Snort rule for syn flood attacks - Limiting number of alerts
So I have a snort rule that detects syn flood attacks that looks like this:
alert tcp any any -> $HOME_NET 80 (msg:”SYN Flood - SSH"; flags:S;
flow: stateless; detection_filter: track by_dst, ...
34
votes
6answers
15k views
Is it possible to detect 100% of SQLi with a simple regex?
I'm wondering if it is possible to detect 100% of the possible SQLi attacks using a simple regex.
In other words, using very simple PHP code as an example:
if (preg_match("/select/i", $input)) {
...
1
vote
1answer
35 views
Multiple outbound TCP/8333 connections containing the EICAR test string
An IPS / IDS / UTM detects 50 connections from a single client containing Virus/Worm Eicar test string within half an hour. The destinations are IP addresses all around the world on port TCP/8333.
A ...
0
votes
0answers
36 views
Can an IDS be used for detecting frames (not packets) from an non-authenticated station
Can an IDS, like snort, be used to detect Layer 2 network frames from a system i.e a system is trying to send a frame to the AP and whether Snort can work on the frame based on the rules?
0
votes
1answer
52 views
Can Snort or Suricata *edit* packet on the fly?
I know that they can detect traffic by rules, but can they modify packets on the go?
For example, not only detecting HTTP GET but also adding headers to the GET packet.
If they can't, is there an ...
0
votes
1answer
88 views
intrusion prevention system detected “et policy pe exe” should i worry
I have a UniFi Security Gateway (USG Pro 4P) and just enabled IPS (intrusion prevention system). I am seeing many "ET POLICY PE EXE or DLL Windows file download HTTP" alerts. I have not been able to ...
1
vote
2answers
129 views
Windows process documentation for tuning Sysmon
I recently installed Sysmon, which logs events to OSSEC and currently monitors several endpoints. I have been trying to whitelist benign processes such as Windows services. Many of these processes run ...
1
vote
2answers
77 views
Is there any methodology to detect smart deauthentication attack?
I'm a project student in IIT-Hyderabad. I have been working in Wifi security domain for my M.Tech. In particular, I chose de-authentication attack.
Whenever I sent De-Auth frames continuously to APs ...
1
vote
2answers
513 views
How to connect a Raspberry Pi IDS to the home router to detect intrusions network wide?
I'm configuring a raspberry pi IDS/IPS with ELK stack on a separate machine, my problem is to connecting it to the router in a way it can read traffic on the whole network and drop the suspicious ...
1
vote
1answer
78 views
Chain of causality in Equifax breach (expired certificates disabling IPS capabilities)
I am researching the Equifax breach described here:
https://oversight.house.gov/wp-content/uploads/2018/12/Equifax-Report.pdf
Apparently the attack went undetected for a long period of time and the ...
1
vote
0answers
76 views
sandboxing IoCs and signatures
Sandboxes are used for automated extraction of indicators of compromise (IoCs) that can be used to write signatures. Can this signature then be used, for example, on an IPS system to block certain ...
3
votes
3answers
127 views
Should I block IP adresses that made attacks attempts and were block from an IPS through the rules?
We have an NIPS blocking attacks based on bad behaviors (rules checking the data in the network packets). Should I block the IP that the NIPS linked to attack attempts? It feels like the NIPS is ...
0
votes
0answers
45 views
Why would IPS vendor provider refuse to publish SLAs to fix the published highly ranked CVEs?
One of the biggest IPS providers (top of Gartner graph for its category) is not providing SLAs for all the 7+ ranking CVEs published last year. I don't really understand why would they refuse to ...
-2
votes
1answer
77 views
Penetration testing or Malware analysis? [closed]
My M.Sc research is about developing IDS for IOT.
I'm confused about which field should learn more about; penetration testing or malware analysis.
I have some knowledge about each one but for IDS, ...
0
votes
1answer
57 views
How likely is it to see a commercial IDS/IPS that uses machine learning in the near future that performs better than a normal IDS/IPS? [closed]
I have to choose a field to study on and I want to know does it worth studying in this field and will the future IDS/IPS systems be using machine-learning/deep-learning or at least how likely is it?
...
0
votes
1answer
412 views
IDS and IPS placement in network? [duplicate]
What is the good practice for the placement of IDS (NIDS) and IPS? Before the firewall or after the firewall? and why?
3
votes
2answers
263 views
How IDS and Firewall Logs are aggregated and feed aggregated log to SIEM?
I am studying SIEM tools.
Firewall logs will be different from IDS logs and even from Antivirus logs.
How can log aggregation take place?
1
vote
3answers
82 views
How useful is it to prevent Linux applications from setting up any untrusted connections, and can it be done easily?
Threat: your Linux machine gets compromised in some way (untrusted app, or compromised install package or update, or an app is compromised because of a vulnerability, etc.) and something on your ...
0
votes
1answer
177 views
Loopback with Suricata
Is there any way of analyzing loopback traffic with Suricata?
I am trying it this way without success:
root@security-onion:/home/sar/TFM/alerts/suricata# suricata -c /etc/suricata/suricata.yaml -i ...
0
votes
1answer
265 views
How can Insertion attack ever work and fool an IDS on a TCP connection?
An IDS can accept a packet that an end-system rejects. An IDS that does this makes the mistake of believing that the end-system has accepted and processed the packet when it actually hasn't. An ...
-1
votes
0answers
189 views
snort rules are enabled by pulledpork but in the same time are skipped?
I am using pulledpork for management of rules. I had enabled rules from 1:1000 to 1:5735 those rules are enabled but in the same time are skipped.
As output I had:
https://github.com/shirkdog/...
1
vote
0answers
94 views
Snort not working with IDSWakeup
I have setup Snort with the registered user rules installed.
I tested first by making the following rule in local.rules:
alert icmp any any -> $HOME_NET any (msg:"ICMP test"; sid:10000001; rev:...
2
votes
0answers
225 views
How can I get Suricata to alert on 1 packet every time
I am trying to write a Suricata signature for testing purposes to alert every time it is triggered with a single PCAP file containing a single packet, but this is proving to be harder than I thought.
...
0
votes
1answer
847 views
Comparison between WAF and IPS/IDS
I would like to know the difference between WAF and IPS/IDS?
Can IPS/IDS handle an attack on a web application?
If there are differences functionally between the two applications, how they work ...
0
votes
0answers
28 views
0 dynamic rules read
I am running Snort as IDS in Security Onion and get this message: 0 Dynamic rules
All SO_RULES are loaded in snort.conf in the correct path.
25867 Snort rules read
23950 detection rules
...
2
votes
1answer
791 views
Suricata: nmap scan does not match rules
I am using suricata with emerging-scan.rules and other rules. The rules are loaded in the suricata.yaml, homenet and ext_net are configured correctly.
For testing detection of suricata I used nmap -...
4
votes
4answers
968 views
Benefit of using two network interfaces for intrusion detection system
What is the benefit of using two network interfaces (management interface and sniffing interface) for an IDS such as Snort? I have used a Snort IDS where it only used one network interface for both ...
1
vote
2answers
98 views
Could an IPS have blocked an attack on a vulnerable router/firewall?
Thinking about the recent news regarding SOHO routers vulnerable to the VPNFilter attack: https://arstechnica.com/information-technology/2018/05/fbi-tells-router-users-to-reboot-now-to-kill-malware-...
2
votes
1answer
912 views
How does IPS terminate/decrypt encrypted traffic?
With regards to IPS, I am not completely across how they are supposed to terminate or decrypt encrypted traffic? It makes absolutely sense to deploy them inline, but how is traffic supposed to be ...
3
votes
0answers
77 views
PS4 gift card online purchase asked for photo ID
I purchased ps4 gift card online and they asked for ID verification. Which I have to take a photo of my ID front and back and a selfie. Is that safe and can they do anything with this information? I ...
1
vote
0answers
115 views
Blind XSS being intercepted by Palo Alto Tech OPs
I am doing a penetration test and I have a form that accepts any input. Whenever a form is submitted, a message of "Thank you, you will be contacted shortly" appears.
Acunetix detected a blind XSS ...
3
votes
1answer
431 views
Examples of non signature based anti-malware/anti-virus programs, IDS, & system integrity scanners
All traditional anti-virus software uses signatures to detect known malware after it has been discovered by the software companies and added to the definitions. Heuristic definitions allow a piece ...
0
votes
1answer
237 views
With an IPS in place, do we really need firewalls?
I was reading the article "Do you need an IDS or IPS, or both?"
on TechTarget. While reading the author's explanation of IPS this question hit me.
If an IPS is a control tool that uses a set of ...
0
votes
0answers
403 views
Snort.log output as unreadable symbols
I have recently installed Snort IDS on Linux Ubuntu 16.04LTS (not server), after experimenting and testing configuration in VitualBox.
After installing and successfully validating the configuration ...
6
votes
3answers
238 views
Tripwire report shows modification dates from when I was on vacation with computer shutdown at home
Tripwire report shows modification dates from when I was on vacation with computer shutdown at home - how is this possible?
here is one of many examples:
Modified object name: /lib/x86_64-linux-gnu/...
2
votes
0answers
155 views
What is the best way to test my anomaly detection system?
I have an IDS (Intrusion Detection System) built in C and I need to test it with real traffic. It is an anomaly detection system, so I need to train it with normal traffic first.
The IDS that I built ...
-2
votes
1answer
183 views
Anomaly based IDS Vs Protocol state based IDS
Is there any difference between them? On google, I can find many description about anomaly based IDS. But I can not find any description about protocol state based IDS.
2
votes
0answers
29 views
How to make a succesful mimicry attack when normal clusters are very small?
Anomaly detection IDS, sometimes, are designed to prevent mimicry attacks.
After the algorithm has done the clustering, there might be few and small clusters. The attacker will have problems with ...
4
votes
2answers
1k views
What is the difference between an anti-virus and an IPS?
As I understand it, an intrusion protection system (IPS) detects anomalous behavior, does detection of protocol anomalies, and does signature filtering that blocks malware, DDoS, etc. An antivirus ...
1
vote
1answer
1k views
IDS Snort rule to catch Slow-Loris
I'm trying to write a rule to catch a Slow-Loris attack, this is what i have -
alert tcp any any -> any any (msg:"Possible Slow Loris attack"; classtype: denial-of-service; flow: to_server, ...
-1
votes
2answers
109 views
WAF/IDS detection question
I've been writing scripts to identify WAF's on websites, and have come across one that appears, A LOT.
The HTML always looks like this:
<title>403 Forbidden</title>
</head><...
0
votes
2answers
732 views
What do you call an antivirus that detects suspicious activity?
A traditional antivirus scans data at rest and data in transit for known virus signatures. (Where "virus" includes trojans, rootkits, et al.)
This does not help when defending against zero-days and ...
1
vote
2answers
490 views
Intrusion Detection System (IDS / IPS) useful for Linux home users?
Can an Intrusion Detection System or Intrusion Prevention System (IDS / IPS) increase the security of home users using Linux?
Or is an IDS / IPS even less useful than antivirus for Linux?
Is an IDS /...
2
votes
0answers
60 views
Challenges of modern implementations of Network “Time Travel” analysis
I was reading this paper about the creation of network "time machines". This paper has some interesting ideas but they're largely applied to "traditional" network environments.
What kind of ...
0
votes
1answer
602 views
Combine SNORT detection and log with active response OSSEC
As far as i know, NIDS implemented in Network layer and HIDS in Host-based layer, Is it possible for NIDS( for example: Snort or suricata ) log that will included in HIDS(for example: OSSEC) log too ? ...
2
votes
2answers
208 views
Can dual NIC Snort machine cause threats to bypass firewall?
I am thinking about building a Linux Snort machine that can listen to both WAN and LAN traffic.
Setup I am thinking about:
Snort computer with two NICs
One NIC connected to hub/tap outside firewall (...
1
vote
0answers
154 views
Identifying privilege escalation in OSSEC logs [closed]
I am working on an intrusion detection system which can prioritize and attribute the logs generated by OSSEC. So, how can I understand a privilege escalation case (or just the privileges a user has at ...
