Intrusion Detection Systems
3
votes
1answer
110 views
Isn't a HIDS, NIDS and WAF complementary?
Assume this scenario:
Someone trying to hack a website. Simply put: www.site.com/example.php?=<script>alert(1)</script>
A HIDS would see this attempt in Apache's access log, a NIDS would ...
1
vote
1answer
21 views
How to configure Suricata to not interfere with virtual machine
I'm currently planning on setting up Suricata as a firewall on my laptop. I'm wondering however if it's possible to set Suricata to not interfere with traffic to and from specific virtual machines ...
2
votes
1answer
65 views
IPS/IDS and Firewall Solution(s) to a Small Office
I was tasked with implementing a network security solution for a small real estate agency. They are a typical old-school mom and pops shop, about 15 employees with basic file sharing, printing, and ...
1
vote
1answer
47 views
Locate rogue wireless access point using Kismet data
Is there any way how to use Kismet data to locate rogue wireless access points?
1
vote
0answers
51 views
Snort Rule Writing (Alert Fires But Traffic Does Not Match *Intended* Rule)
I have the following rule:
alert tcp $HOME_NET any > $EXTERNAL_NET any (msg:"This should not happen"; flow:established,to_server; content:"GET "; depth:4; content:"Set-Cookie:"; http_header; ...
0
votes
1answer
106 views
NGINX Hacking Attempt
Every time I start my test-server and let it run for some days I get this in my log-files (in different variations):
111.241.26.165 - - [18/Feb/2014:22:16:45 +0100] "\x04\x01\x00\x19\xCBER!\x00" 400 ...
2
votes
1answer
59 views
New to ossec - what does active response do out of the box
I am new to ossec. I installed the server and wui on a dedicated machine. I have agents running on my zookeeper and kafka servers to start.
Below are events I am seeing. I assume the are ...
0
votes
0answers
52 views
Snort not showing dropped/blocked packets
This question is about SNORT- I m basically trying to detect PING FLOOD attack.
I have included the
rule**(drop icmp any any -> any any (itype:8; threshold, track by_src, count 20, ...
0
votes
1answer
44 views
Industry standards for threat names
One of the security appliances we own reports a so-called "Industry Name" for the threats it detects on the network. I wanted to know if there is really such a standard and where I can find ...
0
votes
1answer
110 views
Cryptic threat names
I have logs from a security appliance from Damballa which has cryptic names for threats observed in a network which I am trying to make sense of. Some examples of these threats are "RedTreeBruisers" , ...
-4
votes
2answers
69 views
Ips used by the same person?
Is it possible to find out if ips are from the same location and used by one person. We have a situation were three ips have been logged etc. We know for sure that two are from the same person this ...
0
votes
1answer
57 views
IDS false positive rates
Are there any industry accepted standards for the false positive rates for a Network IDS based on Snort? Is there a way to check the false positive rates in a deployed IDS? (ideally without looking at ...
0
votes
1answer
51 views
Intrusion Detection and Prevention technologies [closed]
I'm supposed to do a research paper on a recent technology and I thought of doing it on a technology in information security. I found interest on Intrusion detection and prevention systems (IDPS) but ...
0
votes
1answer
58 views
What are some good ways to audit trustworthiness of InfoSec solutions consulting companies?
When it comes to choosing new vendors and suppliers, the old method was to get in contact with the company and ask around their local neighbourhood and with their customers to see how trustworthy the ...
7
votes
2answers
219 views
What criteria should be used for manually reviewing / prioritizing failed logins?
I have a web application that is exposed to the Internet, and am interested in creating alerts, or prioritizing the manual review of failed logins to the web application.
What thresholds, or ...
3
votes
1answer
78 views
Tracking down the source of email attacks
For the past week our company's IDS has been blocking 100-200 meeting invite emails per day from a specific client that are loaded with buffer overflows targeted at Exchange 2003. The payloads are ...
2
votes
1answer
39 views
Do generic custom scripts avoid detection more than common security applications?
Are scripts coded only using the default API of a high level, interpreted language for generic and meticulous gathering of network device & host software information that are already available ...
3
votes
7answers
281 views
How does an IDS identify a computer ?
How does an IDS identify a computer on the network. I mean do IDS' actually check whether a device is actually what it claims to be ? If so what factors does it check (MAC etc) ?
For e.g. if a ...
0
votes
2answers
125 views
Questions on IDS, IPS, VLANs and VPN [closed]
I have a network that has a single point of entry the WAN. The WAN exposes about 10 static IP's that resolve internally to servers that are in the same subnet. Meaning that if you RDP over 3389 to ...
1
vote
1answer
80 views
Botnet callback patterns
I am trying to understand the network behavior of bots. Are there any identifiable characteristics of callback requests from the bot to the C&C server which differentiates it from normal traffic?
...
1
vote
1answer
81 views
How to properly configure OSSEC for Web Application Security ?
I would like to implement OSSEC as HIDS on my server, but by default OSSIC monitors a number of folders. I am going to deploy a web application on my server. So what should be my default OSSEC ...
4
votes
3answers
2k views
Difference between IDS and IPS and Firewall
The differences between an IDS and a firewall are that the latter prevents malicious traffic, whereas the IDS:
Passive IDS: the IDS only reports that there was an intrusion.
Active IDS: the IDS also ...
1
vote
1answer
121 views
OSSEC on an existing running machine
I am setting up a OSSEC on existing running machine. From my research I find that I should be running the following command to check for previous intrusion.
zcat /var/log/*.gz | ...
1
vote
1answer
45 views
Moving all servers to routeable IP Addresses
Company I am consulting to wants to move all their servers from private IP space to public IP space. I'm am trying to convince them that this is a bad idea that it makes sense to move only certain ...
6
votes
3answers
523 views
How could malware like Stuxnet be detected?
Stuxnet and others in this list of state-of-the-art Internet worms had certain features that they were very stealthy in leaking out the information they harvested. Thus it managed to go under the ...
1
vote
2answers
106 views
Can IPS system be used as IDS and vice versa
I would like to know can an Network Intrusion Prevention System[IPS] be used as an Network Intrusion Detection System[IDS] and vice versa.
Can the Host based IPS be used as a host based IDS and vice ...
1
vote
2answers
266 views
Suricata IPS rules for honeypot
I have a really simple high interaction honeypot and I have just installed a VM as an IPS (suricata) with a transparent bridge between my router and the honeypot. The setup looks something like this:
...
2
votes
1answer
404 views
IPS fail close vs IPS fail open, what are the risks and benefits?
If a desicion is to be be made on selecting a mode of fail for an inline IPS that is protecting servers, what are the criteria that should be considored for selecting one of the failure modes:
1- ...
1
vote
0answers
58 views
Alert correlation benchmark [closed]
I'm looking for some alert correlation tool to reduce number of alerts about 50%. It should support IDMEF. I googled for alert correlation tools but just found ACARM-ng, TIAA and MACE and all of them ...
2
votes
3answers
175 views
Make OSSEC ban ip on remote firewall
I am deploying OSSEC architecture agent-server mode.
I want the server to ban ip not only on agent but also on a remote firewall (dedicated iptables server).
I've seached on the OSSEC's ...
0
votes
0answers
54 views
State transition Analysis Technique
As far as I have read and understood STAT is a concept used to design a platform independent IDS.
My doubt is whether there exists any compiler/interpreter for STAT Language as I am planning to do a ...
1
vote
2answers
448 views
Sending Syslog/SNMP information over the internet using standard UDP port 514
I'm looking into monitoring a Windows VPS by sending Syslog messages to a Synology NAS, which can generate email alerts and such. I also would like to use SNMP to generate health stats, and see trends ...
1
vote
1answer
225 views
WAF testing frameworks
How to test the effectiveness of a Web Application Firewall (WAF), or any other security control that is put in place to protect the web application from being attacked? Currently, what are the ...
4
votes
2answers
417 views
Event monitoring for a home network
I'd like to utilise some of the free SIEM type products out there to increase the chances that I will detect attacks and compromises of any of the devices on my home network. Most of my home devices ...
-1
votes
1answer
72 views
What steps are performed when a serious event reaches an Intrusion Detection System? [closed]
For example, you are using Snort and you just got a serious event, which states that a certain service is attacked.
What do you do with the threat source IP?
What are the steps that network event ...
-2
votes
2answers
77 views
Block all kind of querys from ip [closed]
I want to check my network intrusion detection system (physical intrusion like unauthorized gadgets or devices in wifi/ethernet). Until now everything is ok, but I was wondering if I block every query ...
6
votes
2answers
312 views
Detecting Pass-the-Hash
I was wondering what you guys are doing to detect attacks like Pass-The-Hash within your network. I've read about Breachbox
...
0
votes
0answers
14 views
Should signature based NIDS detect malicious documents or executable malwares? [duplicate]
Two kinds of client side attacks are explained here, offensive-security.com: (1) just binary payloads and (2) exploit+payloads. Is it the responsibility of NIDS to detect them? It is the payload or ...
6
votes
3answers
203 views
Out-of-the-box Network Intrusion Appliance for non-Power User
First, let me apologize if any of this question is naive or beneath the scope of this board. Bear in mind the context and that I'm asking as an attempt to exhaust all resources.
Also, I understand if ...
1
vote
1answer
699 views
What is the best place to put my IDS network sensor? [duplicate]
I can only place a single network sensor somewhere within my network. Would it be best placed between the border router and firewall, or between the firewall internal LAN?
2
votes
0answers
217 views
Security Onion:snorby alerts shows all local nerwork source IP(public and private)
I have just installed Security Onion distro based on ubuntu. This distro does a great job of combining multiple tools like snort/suricata,sguil,snorby,elsa,bro ids,squert. In my Security Onion ...
2
votes
1answer
2k views
Snort/IDS detect and alert on possible DoS/DDoS attack?
As per the title, I'm attempting to configure Snort to detect and alert on a incoming Denial of Service attack.
Looking at the rulesets, which are primarily signature based rules, I can't see a ...
3
votes
2answers
475 views
Example of malware that spreads via USB? [closed]
I'm messing with Mandiant Redline on Windows Server 2012 in a VM and I wanted to download a sample virus that spreads via USB and modify it to attack Mandiant Redline - I've never written malware ...
4
votes
1answer
99 views
Security / logging on a Xen-based VPS instance?
Our company has a Xen-based instance on a VPS provider and we have some sensitive data stored on it. Is there a way for me to tell if/when employees of the hosting company have accessed my VPS (by ...
0
votes
1answer
62 views
How to specify a Snort rule connection duration?
Is it even possible to specify into a snort rule the duration of a connection?
For example: in this format Hour, Minute, Second
H, M, S = 0, 2, 1
If a connection that has the duration of 2 minutes ...
2
votes
1answer
407 views
How to add wildcards to snort rule ip address?
Is it possible to add wildcards or something that would function like them to a snort rule IP address?
For example:
If I'd like to detect source-ip of: 192.168.*.9
Where the third octet can be ...
4
votes
1answer
112 views
Integrity check against package repository?
I have a Debian installed. When there are security updates, I review and install them as soon as possible and think about using automatic updates.
From time to time I want to boot from a clean boot ...
1
vote
2answers
246 views
SYN scan, TCP packet question
during SYN scans, many small tcp packets are sent to multiple ports to determine which ports are open or not. But when you're streaming media, aren't you receiving many
One type of ID system, the ...
3
votes
1answer
666 views
Does Web Apps and Databases running on AWS EC2 need a IDS/IPS?
I have googled around for information about Web Apps or Databases running on AWS EC2 needing a IDS/IPS or not.
I will present my findings so far here, but it will be good if you guys can confirm ...
3
votes
1answer
2k views
Snort (IDS) Don't show Port Scans
I have install Snort & acidbase by this instruction and access it through this local address
127.0.0.1/acidbase/base_main.php
The problem is after scan it with nmap by this command
sudo ...
