Questions tagged [ids]

Intrusion Detection System, a system for detecting and alerting based on behavior.

Filter by
Sorted by
Tagged with
0 votes
0 answers
63 views

Snort content syntax

Is it possible to use the symbols <, /, >, space, in the content option of a Snort rule? Or should I use URL encoding instead? Which syntax is correct? content:"%3Cscript%20" content:&...
S_I's user avatar
  • 1
0 votes
0 answers
83 views

Snort fails when run as a service

I've got Snort compiled, configured, and running. Only problem I have is that it fails when I try to run it as a service. I've mainly been using the guide from here: https://snort-org-site.s3....
David Stringham's user avatar
1 vote
1 answer
90 views

Would monitoring for unusual process execution help identify intrusions on a web server?

I have a web server with each web application running as it's own machine level account. The server only hosts the web applications, no other services, dbs, etc. Apart from the web server processes, ...
Jonno's user avatar
  • 155
0 votes
0 answers
59 views

Is it possible to count SYN and ACK flags separately in a single rule in Snort?

I want to write a rule for Snort to detect lost traffic in the network. Is it possible to write a rule that, by combining two flags, SYN and ACK, it declares that if the number of SYNs to the server ...
user16385455's user avatar
1 vote
1 answer
131 views

Snort / Suricata rules from HOME_NET with rule option flow:to_client

Reading through Suricata/Snort IDS rules, I can see examples such as below, and scratching my head to understand how is it feasible that a connection from home_network to external_network can have a ...
RGC's user avatar
  • 11
0 votes
1 answer
228 views

What security issues could occur when generating ids on the client?

It's sometimes convenient to generate ids client-side in a typical CRUD app. The main benefit is for optimistic updates: you can update your client state with the right id without waiting for the ...
Emmanuel Meric de Bellefon's user avatar
3 votes
2 answers
2k views

Intrusion detection in a small home network

The number of devices in my home network keeps growing: Apart from my gaming PC and our home office notebooks, we have the kids' tablets, all our smart phones, a smart TV stick, some WLAN peripherals, ...
Heinzi's user avatar
  • 3,088
2 votes
2 answers
428 views

Bypass network security filters with CDN

I read about Domain Fronting technique, it bypasses network security filters but requires a relatively complex configuration (having evil.com pointing to a.cdn.net, and good.com pointing to b.cdn.net, ...
user32725's user avatar
0 votes
0 answers
77 views

WIPS and IDS vs NDR

My organisation has a Network Detection and Recovery (NDR) but does not have an WIPS/ WIDS. Because NDR is usually hooked to the core switch, is this enough to detect and mitigate against threats ...
Ethic Or Logics's user avatar
0 votes
1 answer
283 views

Difference between to_server and from_client in snort

I am trying to wrap my head around the difference between the different flow options in Snort. There are four directional flow options: Option Description 1) to_client Trigger on server ...
Deepak's user avatar
  • 103
1 vote
0 answers
87 views

Can you configure Tripwire to produce an actual diff between modified files

I'm using the open source version of Tripwire on Ubuntu 22.04. Right now when a file is modified Tripwire will document this in the integrity check with an "Expected" vs "Observed" ...
Zzgooloo's user avatar
0 votes
0 answers
95 views

Does fragrouter work with OpenVPN?

My goal is to evade IDS/IPS detection and scan the target with nmap. If the scan is detected, the target seems to stop responding for 10s. I think that IP Fragmentation Attack is exactly what I need. ...
ksenia pi's user avatar
1 vote
1 answer
627 views

Why do I need an IDS/IPS in a serverless cloud environment?

Following this question (Why do we need IDS/IPS if a firewall is present?) from a few years back, I am trying to take this subject to the cloud. Assuming that I have a fully "serverless" AWS ...
Nir Levy's user avatar
  • 111
-1 votes
1 answer
2k views

Can the usage of Wireshark be detected when sniffing for packets in promiscuous mode? [duplicate]

I know that port scanning can set off IDS systems on certain networks due to the suspicious traffic it generates. Can the usage of Wireshark be detected on a network? If so, will using it set off any ...
GreatWhite's user avatar
0 votes
0 answers
392 views

Are IDS/IPS already implemented on Google Cloud?

I have a partner that is asking "Do you use breach detection/prevention tools?". I host my service on managed hosting (Heroku) and currently migrating to Google Cloud. Should I be using &...
Dev01's user avatar
  • 101
2 votes
1 answer
392 views

What is the best way to create a PCAP file containing malicious traffic?

I'm in my last year of university and for my honour's project I am tasked with comparing two intrusion detection systems, snort and suricata, hosted on a virtual machine on my PC. As I have no access ...
Conor's user avatar
  • 21
0 votes
0 answers
488 views

How to determine Snort rules source & destination IP and port

How do you figure out Snort's source & destination IP and port if the question is so vague? For example: Write a snort rule that detects a UK NI number sent from a client's web browser to a web ...
Elaine's user avatar
  • 1
0 votes
1 answer
1k views

suricata http rule to identify POST requests

I can’t figure it out / understand. Need to write a rule that catches an HTTP POST request from one ip address more than three times in 10 seconds and logs it. alert http $EXTERNAL_NET any -> $...
Norfo4ik's user avatar
  • 101
0 votes
1 answer
431 views

Misuse vs anomaly detection alerts

Adam always reads his e-mails on Sundays around 5 pm. This Saturday, at 11 am, he accessed his inbox. Which will generate a false positive? Source slide 10/41 Misuse-based IDS or anomaly-based IDS? ...
Team B.I's user avatar
0 votes
1 answer
144 views

Are sequential patterns used in practice?

I study computer security and I read articles about the potential usage of sequential pattern mining in IDPS products: Database intrusion detection using role and user behavior based risk assessment ...
inf3rno's user avatar
  • 489
0 votes
0 answers
146 views

Is every packet of a hostile network flow hostile?

We are building a packet based anomaly detection system and I'm trying to find labeled packets. Such dataset doesn't exist based on my search, but I can find labeled flows. Can we say that every ...
user128576's user avatar
1 vote
0 answers
176 views

Can I write a suricata rule based on the timestamp the packet arrives on the host?

We have a need to check the arrival time of two relative packets, like packet1 and packet2, if packet2 arrives too late after packet1, we want an alert for it. Is it possible to write a rule for this? ...
cifer's user avatar
  • 111
1 vote
1 answer
159 views

Preventing DDOS attacks without collecting personal data? [closed]

Could anyone suggest a system to prevent DDOS attacks without collecting personal data like i.p. addresses ( or using anonymized data ) and be not deny access to an innocent user ?
savegoodlyfnotendorsinganswer's user avatar
1 vote
1 answer
2k views

SNORT rule for detecting/preventing unauthorized VPN or encrypted traffic

Here's my not so theoretical scenario: A day-one Trojan horse attack where the attacker sets up a secure connection back to himself using a well known trusted port, such as 80 21 443. Or for instance, ...
TaranYourAss's user avatar
1 vote
0 answers
96 views

How does one label malicious traffic in generated workloads?

I have been writing on some code that automatically puts together differently parameterized attacks of common pen testing tools, i.e. sqlmap, nmap, patator etc. These attacks are then launched against ...
cybel's user avatar
  • 111
0 votes
1 answer
592 views

Is there any advantages in using a Network Intrusion Detection System, when already having a EDR solution?

Does implementing a Network Intrusion Detection System (NIDS) give you any advantages over an Endpoint Detection and Response (EDR) solution? I've been trying to do research on this, but are ...
Grenair's user avatar
2 votes
1 answer
246 views

Processing Exceptionally High Volume Singular Flows

I wanted to know if anyone had experience sensoring single flows that generate 90 kpps or upward of traffic. My conundrum is that I use tools which I would like to be able to properly see an entire ...
ReedGhost's user avatar
  • 123
0 votes
1 answer
3k views

Suricata - How to use TCP Flags?

I wrote the following rules: alert tcp any any -> 192.168.6.4 any (msg:"SYN"; flags: S;) alert tcp any any -> 192.168.6.4 any (msg:"FIN"; flags: F;) The SYN rule is matching....
flippie's user avatar
2 votes
1 answer
2k views

Snort Inline Mode(IPS) Routing Packet Forwarding

I'd like to build an IPS which would be a seperate endpoint than the router and/or protected servers. To achieve this I've installed to my Ubuntu server Snort with DAQ(AFPACKET). The instructions I've ...
TheSoulkiller's user avatar
1 vote
2 answers
254 views

script encoder for IDS test

Encoding a payload is a means of evading antivirus or IDS. With regard to scripts is there a way to do the same thing? For instance, is it possible to encode a python script in order test intrusion ...
t5j's user avatar
  • 49
0 votes
1 answer
232 views

Help in Suricata rule bitmask syntax problem

I have written the following rule in my Suricata rules file: alert tcp any any <> any any (flow:established; content:"|65|"; offset:0; depth:1; byte_test:1, =, 3, 2, bitmask 0x03; msg:&...
Khalid's user avatar
  • 183
3 votes
1 answer
379 views

PCI-DSS Level 1 requirement for Intrusion Detection and Prevention on AWS API Gateway and AWS Lambda

Our architecture is based on the best practices for PCI-DSS on AWS Amazon WAF -> API Gateway -> AWS Lambda The lambda's are running within a VPC and the SG / Firewall and segmentation have been ...
Simon's user avatar
  • 153
0 votes
1 answer
327 views

Suricata Ripple20 rule for IP-in-IP resulting in 100M alerts

I found too many events in Suricata after recent update regarding this rule: alert ip any any -> any any (msg:"ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free"; ip_proto:4; ...
Giac's user avatar
  • 175
0 votes
0 answers
227 views

What happens if a sender changes the TCP window size over multiple packets that have the same ACK number?

I'm currently doing research on evasion attacks that seek to bypass a Deep-learning based Network Intrusion Detection System. In order to achieve this, I need to know what the constraints are for the ...
Gints Engelen's user avatar
1 vote
1 answer
1k views

Suricata and rules based on MAC address

I'm working on a project to implement SDN in a network. One of my flows is redirecting to the Suricata IDS and the flow works in layer 2 with MAC address. Since I've read that Snort only works in ...
loi219's user avatar
  • 113
-1 votes
1 answer
215 views

Snort automatic protocol detection

Does Snort have the "automatic protocol detection" function like Suricata? I read that Snort 3 has "Autodetect services for portless configuration" feature. Does it mean that this ...
ustavsaat's user avatar
1 vote
2 answers
7k views

Difference between Zeek (Bro) and Snort 3

I'm trying to find difference between Zeek and Snort 3. Сan anybody tell me what are the advantages of Zeek against Snort 3?
ustavsaat's user avatar
0 votes
1 answer
877 views

ids - How do I match any string in a list of snort contents?

If I do something like alert tcp any any <> any any (content:"TestA"; content:"TestB"; sid:1000000; msg:"Syntax correct!";) then the syntax is correct, but, what I would like to do is to ...
Salviati's user avatar
  • 101
0 votes
1 answer
181 views

Is there a way to lock down a network? [closed]

If supposing I discover that my network is being attacked by some hacker or is being compromised in any way and I am able to detect it. So, is there any software-oriented way of 'locking-down' the ...
neel g's user avatar
  • 111
-1 votes
1 answer
774 views

Whats The Point of GeoBlocking if the Firewall Has An Implicit Deny?

What is the point of geoblocking IP addresses with cisco firepower or a similar service if the firewall would block the request anyway? For example, We only do business in the USA but see source IP's ...
errMSG's user avatar
  • 197
2 votes
1 answer
158 views

Deciding between MDR solutions offering endpoint agents with or without an additional network appliance?

There are a number of different Managed Security Service Providers (MSSPs) offering managed detection and response services. They tend to use what is called an endpoint agent, while only some use a ...
Saturn_V's user avatar
0 votes
0 answers
133 views

Possible to verify the integrity of AIDE itself?

I recently installed the package AIDE (Advanced Intrusion Detection Environment) on my Linux server. This is a web server installed about a year ago. Since no integrity checks have been done before on ...
pmbonneau's user avatar
  • 191
0 votes
1 answer
1k views

Is fail2ban an intrusion prevention system?

I know what fail2ban does; it monitors the firewall logs and finds ip addresses that have too many failed logins to ssh; and then tells the firewall to drop packets from those addresses. So is ...
leeand00's user avatar
  • 1,431
1 vote
0 answers
294 views

Cost range of IPS solutions [closed]

We have a client web application running in Azure Kubernetes. There was an optional requirement to implement IPS for the application. It was considered optional, because the application that we are ...
Anonymous Platypus's user avatar
1 vote
0 answers
447 views

Snort Content first 3 bytes the same then create an alert [closed]

I was wondering if you could add into a snort rule the ability to only alert if the first 3 bytes match. I think I need to edit the content in my current rule content:"|37 e1 a4|"; I can add the full ...
Daniel Birdsall's user avatar
1 vote
0 answers
305 views

FYP ideas in Applications of Machine Learning in Cyber Security domain [closed]

I am a Computer Science Engineering undergraduate aspiring to pursue a career in the field of cyber security. I have some experience in web application security, memory and network forensics fields. I ...
Picanto's user avatar
  • 11
2 votes
0 answers
109 views

IPS solution for a medium sized web application

As part of application security compliance we are supposed to implement an IPS on our application. The application is basically an educational web portal where students can enrol for course assessment....
Anonymous Platypus's user avatar
4 votes
1 answer
433 views

Difference between NIDS and NBA

I'm having trouble understanding the difference between NIDS (Network-based Intrusion Detection System) and NBA (Network Behavior Analysis) It is to my understanding that NIDS use two detection ...
Xavier59's user avatar
  • 2,924
0 votes
0 answers
173 views

Executable scrambling with Hyperion is detected. What can I do?

I am using Hyperion v2.1 to scramble (polymorphism) some .exe file: hyperion.exe myexefile.exe scrambled.exe The resulting scrambled.exe file is detected and deleted by the AV or IDS system. As ...
Sopalajo de Arrierez's user avatar
0 votes
1 answer
3k views

How to create content rule in Snort

The aim is to detect, if anyone in the HOME_NET is searching for a particular term - say "terrorism" and generate an alert via a content based rule. I am using Snort 2.9 installed in a virtual ...
kgkmeekg's user avatar
  • 113

1
2 3 4 5
9