Intrusion Detection Systems
0
votes
2answers
31 views
Attack Signatures books [closed]
I have an assignment to do for school which involves attack signatures (I have to do a service-specific IDS). Basically what I have to do is to generate signatures for some attacks with Metasploit on ...
0
votes
3answers
44 views
IDS in combination with vulnerability scanner
I'm planning to set up a server environment with high security requirements on which i want to install an intrusion detection system (snort). Additionally, I think of running a vulnerability scanner ...
2
votes
2answers
32 views
server with eth0 promisc-mode vulnerable to attacks outside firewall?
If you use a passive network tap and a server with an eth port in promiscuous mode to monitor all traffic between WAN port of your router and RJ45 port of your ISP cable modem.
Is the IDS instance ...
-1
votes
0answers
26 views
How to filter errors 404 to show only those which are related to php files? [migrated]
One of my web servers is getting flooded with requests to resources that do not exist anymore, generating the corresponding 404 error. As I'm using OSSEC and OSSIM, then these errors are sent to the ...
2
votes
3answers
79 views
EICAR alternative for IDS/IPS
Is there a way to trigger alarms in an Intrusion Detection System with something similar to the EICAR test virus? Maybe some special packet that is harmless to the environement, but will trigger IDS?
...
0
votes
0answers
16 views
Snort 2.9.6.0 to detect malicious nfs traffic [migrated]
I have a snort inline mode IPS.I wanted this IPS to detect malicious nfs traffic.Can anyone please help me out to describe rules that catches the suspicious "nfs" traffic,not allowing it and allow the ...
6
votes
1answer
235 views
Isn't a HIDS, NIDS and WAF complementary?
Assume this scenario:
Someone trying to hack a website. Simply put: www.site.com/example.php?=<script>alert(1)</script>
A HIDS would see this attempt in Apache's access log, a NIDS would ...
2
votes
1answer
56 views
How to configure Suricata to not interfere with virtual machine
I'm currently planning on setting up Suricata as a firewall on my laptop. I'm wondering however if it's possible to set Suricata to not interfere with traffic to and from specific virtual machines ...
2
votes
1answer
98 views
IPS/IDS and Firewall Solution(s) to a Small Office
I was tasked with implementing a network security solution for a small real estate agency. They are a typical old-school mom and pops shop, about 15 employees with basic file sharing, printing, and ...
1
vote
1answer
75 views
Locate rogue wireless access point using Kismet data
Is there any way how to use Kismet data to locate rogue wireless access points?
1
vote
0answers
70 views
Snort Rule Writing (Alert Fires But Traffic Does Not Match *Intended* Rule)
I have the following rule:
alert tcp $HOME_NET any > $EXTERNAL_NET any (msg:"This should not happen"; flow:established,to_server; content:"GET "; depth:4; content:"Set-Cookie:"; http_header; ...
0
votes
2answers
225 views
NGINX Hacking Attempt
Every time I start my test-server and let it run for some days I get this in my log-files (in different variations):
111.241.26.165 - - [18/Feb/2014:22:16:45 +0100] "\x04\x01\x00\x19\xCBER!\x00" 400 ...
2
votes
1answer
104 views
New to ossec - what does active response do out of the box
I am new to ossec. I installed the server and wui on a dedicated machine. I have agents running on my zookeeper and kafka servers to start.
Below are events I am seeing. I assume the are ...
3
votes
3answers
99 views
Log Attacks in Different Files using Snort
How can I log attacks separately using snort. I basically want to log attacks invoked from different files separately. Like if I have 2 files, ddos.rules and log.rules, then I want logs generated from ...
1
vote
0answers
82 views
Snort not showing dropped/blocked packets
This question is about SNORT- I m basically trying to detect PING FLOOD attack.
I have included the
rule**(drop icmp any any -> any any (itype:8; threshold, track by_src, count 20, ...
0
votes
1answer
46 views
Industry standards for threat names
One of the security appliances we own reports a so-called "Industry Name" for the threats it detects on the network. I wanted to know if there is really such a standard and where I can find ...
0
votes
1answer
121 views
Cryptic threat names
I have logs from a security appliance from Damballa which has cryptic names for threats observed in a network which I am trying to make sense of. Some examples of these threats are "RedTreeBruisers" , ...
-4
votes
2answers
70 views
Ips used by the same person?
Is it possible to find out if ips are from the same location and used by one person. We have a situation were three ips have been logged etc. We know for sure that two are from the same person this ...
0
votes
1answer
78 views
IDS false positive rates
Are there any industry accepted standards for the false positive rates for a Network IDS based on Snort? Is there a way to check the false positive rates in a deployed IDS? (ideally without looking at ...
0
votes
1answer
54 views
Intrusion Detection and Prevention technologies [closed]
I'm supposed to do a research paper on a recent technology and I thought of doing it on a technology in information security. I found interest on Intrusion detection and prevention systems (IDPS) but ...
7
votes
2answers
222 views
What criteria should be used for manually reviewing / prioritizing failed logins?
I have a web application that is exposed to the Internet, and am interested in creating alerts, or prioritizing the manual review of failed logins to the web application.
What thresholds, or ...
3
votes
1answer
81 views
Tracking down the source of email attacks
For the past week our company's IDS has been blocking 100-200 meeting invite emails per day from a specific client that are loaded with buffer overflows targeted at Exchange 2003. The payloads are ...
2
votes
1answer
43 views
Do generic custom scripts avoid detection more than common security applications?
Are scripts coded only using the default API of a high level, interpreted language for generic and meticulous gathering of network device & host software information that are already available ...
3
votes
7answers
296 views
How does an IDS identify a computer ?
How does an IDS identify a computer on the network. I mean do IDS' actually check whether a device is actually what it claims to be ? If so what factors does it check (MAC etc) ?
For e.g. if a ...
0
votes
2answers
144 views
Questions on IDS, IPS, VLANs and VPN [closed]
I have a network that has a single point of entry the WAN. The WAN exposes about 10 static IP's that resolve internally to servers that are in the same subnet. Meaning that if you RDP over 3389 to ...
1
vote
1answer
86 views
Botnet callback patterns
I am trying to understand the network behavior of bots. Are there any identifiable characteristics of callback requests from the bot to the C&C server which differentiates it from normal traffic?
...
1
vote
1answer
88 views
How to properly configure OSSEC for Web Application Security ?
I would like to implement OSSEC as HIDS on my server, but by default OSSIC monitors a number of folders. I am going to deploy a web application on my server. So what should be my default OSSEC ...
5
votes
3answers
4k views
Difference between IDS and IPS and Firewall
The differences between an IDS and a firewall are that the latter prevents malicious traffic, whereas the IDS:
Passive IDS: the IDS only reports that there was an intrusion.
Active IDS: the IDS also ...
1
vote
1answer
151 views
OSSEC on an existing running machine
I am setting up a OSSEC on existing running machine. From my research I find that I should be running the following command to check for previous intrusion.
zcat /var/log/*.gz | ...
1
vote
1answer
46 views
Moving all servers to routeable IP Addresses
Company I am consulting to wants to move all their servers from private IP space to public IP space. I'm am trying to convince them that this is a bad idea that it makes sense to move only certain ...
6
votes
3answers
539 views
How could malware like Stuxnet be detected?
Stuxnet and others in this list of state-of-the-art Internet worms had certain features that they were very stealthy in leaking out the information they harvested. Thus it managed to go under the ...
1
vote
2answers
125 views
Can IPS system be used as IDS and vice versa
I would like to know can an Network Intrusion Prevention System[IPS] be used as an Network Intrusion Detection System[IDS] and vice versa.
Can the Host based IPS be used as a host based IDS and vice ...
1
vote
2answers
297 views
Suricata IPS rules for honeypot
I have a really simple high interaction honeypot and I have just installed a VM as an IPS (suricata) with a transparent bridge between my router and the honeypot. The setup looks something like this:
...
2
votes
1answer
537 views
IPS fail close vs IPS fail open, what are the risks and benefits?
If a desicion is to be be made on selecting a mode of fail for an inline IPS that is protecting servers, what are the criteria that should be considored for selecting one of the failure modes:
1- ...
1
vote
0answers
61 views
Alert correlation benchmark [closed]
I'm looking for some alert correlation tool to reduce number of alerts about 50%. It should support IDMEF. I googled for alert correlation tools but just found ACARM-ng, TIAA and MACE and all of them ...
2
votes
3answers
215 views
Make OSSEC ban ip on remote firewall
I am deploying OSSEC architecture agent-server mode.
I want the server to ban ip not only on agent but also on a remote firewall (dedicated iptables server).
I've seached on the OSSEC's ...
1
vote
0answers
60 views
State transition Analysis Technique
As far as I have read and understood STAT is a concept used to design a platform independent IDS.
My doubt is whether there exists any compiler/interpreter for STAT Language as I am planning to do a ...
1
vote
2answers
543 views
Sending Syslog/SNMP information over the internet using standard UDP port 514
I'm looking into monitoring a Windows VPS by sending Syslog messages to a Synology NAS, which can generate email alerts and such. I also would like to use SNMP to generate health stats, and see trends ...
1
vote
1answer
243 views
WAF testing frameworks
How to test the effectiveness of a Web Application Firewall (WAF), or any other security control that is put in place to protect the web application from being attacked? Currently, what are the ...
4
votes
2answers
502 views
Event monitoring for a home network
I'd like to utilise some of the free SIEM type products out there to increase the chances that I will detect attacks and compromises of any of the devices on my home network. Most of my home devices ...
-1
votes
1answer
72 views
What steps are performed when a serious event reaches an Intrusion Detection System? [closed]
For example, you are using Snort and you just got a serious event, which states that a certain service is attacked.
What do you do with the threat source IP?
What are the steps that network event ...
-2
votes
2answers
77 views
Block all kind of querys from ip [closed]
I want to check my network intrusion detection system (physical intrusion like unauthorized gadgets or devices in wifi/ethernet). Until now everything is ok, but I was wondering if I block every query ...
6
votes
2answers
345 views
Detecting Pass-the-Hash
I was wondering what you guys are doing to detect attacks like Pass-The-Hash within your network. I've read about Breachbox
...
0
votes
0answers
14 views
Should signature based NIDS detect malicious documents or executable malwares? [duplicate]
Two kinds of client side attacks are explained here, offensive-security.com: (1) just binary payloads and (2) exploit+payloads. Is it the responsibility of NIDS to detect them? It is the payload or ...
6
votes
3answers
209 views
Out-of-the-box Network Intrusion Appliance for non-Power User
First, let me apologize if any of this question is naive or beneath the scope of this board. Bear in mind the context and that I'm asking as an attempt to exhaust all resources.
Also, I understand if ...
1
vote
1answer
801 views
What is the best place to put my IDS network sensor? [duplicate]
I can only place a single network sensor somewhere within my network. Would it be best placed between the border router and firewall, or between the firewall internal LAN?
2
votes
0answers
230 views
Security Onion:snorby alerts shows all local nerwork source IP(public and private)
I have just installed Security Onion distro based on ubuntu. This distro does a great job of combining multiple tools like snort/suricata,sguil,snorby,elsa,bro ids,squert. In my Security Onion ...
2
votes
1answer
2k views
Snort/IDS detect and alert on possible DoS/DDoS attack?
As per the title, I'm attempting to configure Snort to detect and alert on a incoming Denial of Service attack.
Looking at the rulesets, which are primarily signature based rules, I can't see a ...
3
votes
2answers
510 views
Example of malware that spreads via USB? [closed]
I'm messing with Mandiant Redline on Windows Server 2012 in a VM and I wanted to download a sample virus that spreads via USB and modify it to attack Mandiant Redline - I've never written malware ...
4
votes
1answer
106 views
Security / logging on a Xen-based VPS instance?
Our company has a Xen-based instance on a VPS provider and we have some sensitive data stored on it. Is there a way for me to tell if/when employees of the hosting company have accessed my VPS (by ...
