Questions tagged [ids]
Intrusion Detection System, a system for detecting and alerting based on behavior.
0
votes
0answers
21 views
Windows process documentation for tuning Sysmon
I recently installed Sysmon, which logs events to OSSEC and currently monitors several endpoints. I have been trying to whitelist benign processes such as Windows services. Many of these processes run ...
1
vote
2answers
38 views
Is there any methodology to detect smart deauthentication attack?
I'm a project student in IIT-Hyderabad. I have been working in Wifi security domain for my M.Tech. In particular, I chose de-authentication attack.
Whenever I sent De-Auth frames continuously to APs ...
1
vote
2answers
353 views
How to connect a Raspberry Pi IDS to the home router to detect intrusions network wide?
I'm configuring a raspberry pi IDS/IPS with ELK stack on a separate machine, my problem is to connecting it to the router in a way it can read traffic on the whole network and drop the suspicious ...
1
vote
1answer
61 views
Chain of causality in Equifax breach (expired certificates disabling IPS capabilities)
I am researching the Equifax breach described here:
https://oversight.house.gov/wp-content/uploads/2018/12/Equifax-Report.pdf
Apparently the attack went undetected for a long period of time and the ...
1
vote
0answers
30 views
sandboxing IoCs and signatures
Sandboxes are used for automated extraction of indicators of compromise (IoCs) that can be used to write signatures. Can this signature then be used, for example, on an IPS system to block certain ...
3
votes
3answers
105 views
Should I block IP adresses that made attacks attempts and were block from an IPS through the rules?
We have an NIPS blocking attacks based on bad behaviors (rules checking the data in the network packets). Should I block the IP that the NIPS linked to attack attempts? It feels like the NIPS is ...
0
votes
0answers
38 views
Why would IPS vendor provider refuse to publish SLAs to fix the published highly ranked CVEs?
One of the biggest IPS providers (top of Gartner graph for its category) is not providing SLAs for all the 7+ ranking CVEs published last year. I don't really understand why would they refuse to ...
-2
votes
1answer
51 views
Penetration testing or Malware analysis? [closed]
My M.Sc research is about developing IDS for IOT.
I'm confused about which field should learn more about; penetration testing or malware analysis.
I have some knowledge about each one but for IDS, ...
0
votes
1answer
41 views
How likely is it to see a commercial IDS/IPS that uses machine learning in the near future that performs better than a normal IDS/IPS? [closed]
I have to choose a field to study on and I want to know does it worth studying in this field and will the future IDS/IPS systems be using machine-learning/deep-learning or at least how likely is it?
...
0
votes
1answer
140 views
IDS and IPS placement in network? [duplicate]
What is the good practice for the placement of IDS (NIDS) and IPS? Before the firewall or after the firewall? and why?
3
votes
2answers
161 views
How IDS and Firewall Logs are aggregated and feed aggregated log to SIEM?
I am studying SIEM tools.
Firewall logs will be different from IDS logs and even from Antivirus logs.
How can log aggregation take place?
1
vote
3answers
77 views
How useful is it to prevent Linux applications from setting up any untrusted connections, and can it be done easily?
Threat: your Linux machine gets compromised in some way (untrusted app, or compromised install package or update, or an app is compromised because of a vulnerability, etc.) and something on your ...
0
votes
1answer
114 views
Loopback with Suricata
Is there any way of analyzing loopback traffic with Suricata?
I am trying it this way without success:
root@security-onion:/home/sar/TFM/alerts/suricata# suricata -c /etc/suricata/suricata.yaml -i ...
0
votes
1answer
157 views
How can Insertion attack ever work and fool an IDS on a TCP connection?
An IDS can accept a packet that an end-system rejects. An IDS that does this makes the mistake of believing that the end-system has accepted and processed the packet when it actually hasn't. An ...
0
votes
0answers
116 views
snort rules are enabled by pulledpork but in the same time are skipped?
I am using pulledpork for management of rules. I had enabled rules from 1:1000 to 1:5735 those rules are enabled but in the same time are skipped.
As output I had:
https://github.com/shirkdog/...
1
vote
0answers
60 views
Snort not working with IDSWakeup
I have setup Snort with the registered user rules installed.
I tested first by making the following rule in local.rules:
alert icmp any any -> $HOME_NET any (msg:"ICMP test"; sid:10000001; rev:...
2
votes
0answers
163 views
How can I get Suricata to alert on 1 packet every time
I am trying to write a Suricata signature for testing purposes to alert every time it is triggered with a single PCAP file containing a single packet, but this is proving to be harder than I thought.
...
0
votes
1answer
499 views
Comparison between WAF and IPS/IDS
I would like to know the difference between WAF and IPS/IDS?
Can IPS/IDS handle an attack on a web application?
If there are differences functionally between the two applications, how they work ...
0
votes
0answers
26 views
0 dynamic rules read
I am running Snort as IDS in Security Onion and get this message: 0 Dynamic rules
All SO_RULES are loaded in snort.conf in the correct path.
25867 Snort rules read
23950 detection rules
...
2
votes
1answer
510 views
Suricata: nmap scan does not match rules
I am using suricata with emerging-scan.rules and other rules. The rules are loaded in the suricata.yaml, homenet and ext_net are configured correctly.
For testing detection of suricata I used nmap -...
4
votes
4answers
887 views
Benefit of using two network interfaces for intrusion detection system
What is the benefit of using two network interfaces (management interface and sniffing interface) for an IDS such as Snort? I have used a Snort IDS where it only used one network interface for both ...
1
vote
2answers
90 views
Could an IPS have blocked an attack on a vulnerable router/firewall?
Thinking about the recent news regarding SOHO routers vulnerable to the VPNFilter attack: https://arstechnica.com/information-technology/2018/05/fbi-tells-router-users-to-reboot-now-to-kill-malware-...
2
votes
1answer
549 views
How does IPS terminate/decrypt encrypted traffic?
With regards to IPS, I am not completely across how they are supposed to terminate or decrypt encrypted traffic? It makes absolutely sense to deploy them inline, but how is traffic supposed to be ...
3
votes
0answers
76 views
PS4 gift card online purchase asked for photo ID
I purchased ps4 gift card online and they asked for ID verification. Which I have to take a photo of my ID front and back and a selfie. Is that safe and can they do anything with this information? I ...
1
vote
0answers
103 views
Blind XSS being intercepted by Palo Alto Tech OPs
I am doing a penetration test and I have a form that accepts any input. Whenever a form is submitted, a message of "Thank you, you will be contacted shortly" appears.
Acunetix detected a blind XSS ...
0
votes
0answers
35 views
Calculating the score for Packet Header Anomaly Detection?
I am studying the algorithm PHAD (Packet Header Anomaly Detection) for IDS. I can't understand the principle of this algorithm. Can somebody give me a practical example for calculating the score?
0
votes
0answers
95 views
SSH Tunneling Issue with Plink
so I'm trying to follow this tutorial to bypass firewalls and IDS by routing traffic through an SSH pipe and receiving a Meterpreter reverse shell (reverse_tcp) from a Windows computer across the ...
3
votes
1answer
338 views
Examples of non signature based anti-malware/anti-virus programs, IDS, & system integrity scanners
All traditional anti-virus software uses signatures to detect known malware after it has been discovered by the software companies and added to the definitions. Heuristic definitions allow a piece ...
0
votes
1answer
176 views
With an IPS in place, do we really need firewalls?
I was reading the article "Do you need an IDS or IPS, or both?"
on TechTarget. While reading the author's explanation of IPS this question hit me.
If an IPS is a control tool that uses a set of ...
0
votes
0answers
310 views
Snort.log output as unreadable symbols
I have recently installed Snort IDS on Linux Ubuntu 16.04LTS (not server), after experimenting and testing configuration in VitualBox.
After installing and successfully validating the configuration ...
6
votes
3answers
229 views
Tripwire report shows modification dates from when I was on vacation with computer shutdown at home
Tripwire report shows modification dates from when I was on vacation with computer shutdown at home - how is this possible?
here is one of many examples:
Modified object name: /lib/x86_64-linux-gnu/...
2
votes
0answers
132 views
What is the best way to test my anomaly detection system?
I have an IDS (Intrusion Detection System) built in C and I need to test it with real traffic. It is an anomaly detection system, so I need to train it with normal traffic first.
The IDS that I built ...
-2
votes
1answer
147 views
Anomaly based IDS Vs Protocol state based IDS
Is there any difference between them? On google, I can find many description about anomaly based IDS. But I can not find any description about protocol state based IDS.
2
votes
0answers
25 views
How to make a succesful mimicry attack when normal clusters are very small?
Anomaly detection IDS, sometimes, are designed to prevent mimicry attacks.
After the algorithm has done the clustering, there might be few and small clusters. The attacker will have problems with ...
4
votes
2answers
1k views
What is the difference between an anti-virus and an IPS?
As I understand it, an intrusion protection system (IPS) detects anomalous behavior, does detection of protocol anomalies, and does signature filtering that blocks malware, DDoS, etc. An antivirus ...
1
vote
1answer
926 views
IDS Snort rule to catch Slow-Loris
I'm trying to write a rule to catch a Slow-Loris attack, this is what i have -
alert tcp any any -> any any (msg:"Possible Slow Loris attack"; classtype: denial-of-service; flow: to_server, ...
-1
votes
2answers
83 views
WAF/IDS detection question
I've been writing scripts to identify WAF's on websites, and have come across one that appears, A LOT.
The HTML always looks like this:
<title>403 Forbidden</title>
</head><...
0
votes
2answers
725 views
What do you call an antivirus that detects suspicious activity?
A traditional antivirus scans data at rest and data in transit for known virus signatures. (Where "virus" includes trojans, rootkits, et al.)
This does not help when defending against zero-days and ...
1
vote
2answers
424 views
Intrusion Detection System (IDS / IPS) useful for Linux home users?
Can an Intrusion Detection System or Intrusion Prevention System (IDS / IPS) increase the security of home users using Linux?
Or is an IDS / IPS even less useful than antivirus for Linux?
Is an IDS /...
2
votes
0answers
59 views
Challenges of modern implementations of Network “Time Travel” analysis
I was reading this paper about the creation of network "time machines". This paper has some interesting ideas but they're largely applied to "traditional" network environments.
What kind of ...
0
votes
1answer
497 views
Combine SNORT detection and log with active response OSSEC
As far as i know, NIDS implemented in Network layer and HIDS in Host-based layer, Is it possible for NIDS( for example: Snort or suricata ) log that will included in HIDS(for example: OSSEC) log too ? ...
2
votes
2answers
187 views
Can dual NIC Snort machine cause threats to bypass firewall?
I am thinking about building a Linux Snort machine that can listen to both WAN and LAN traffic.
Setup I am thinking about:
Snort computer with two NICs
One NIC connected to hub/tap outside firewall (...
1
vote
0answers
122 views
Identifying privilege escalation in OSSEC logs [closed]
I am working on an intrusion detection system which can prioritize and attribute the logs generated by OSSEC. So, how can I understand a privilege escalation case (or just the privileges a user has at ...
1
vote
0answers
91 views
Loki/Linux Personal Realtime IDS and/or IPS
In the old days i used to use firewall apps on windows that would have intrusion detection that would alert me while on my system and/or email. For instance, i would see a popup that says: "Warning: ...
1
vote
2answers
94 views
Job Website Identity Verification
I signed up for work at a Job Website so I can do some freelance web development. They have an option where you can verify you are a US citizen so you can apply for jobs that people asked for US ...
0
votes
2answers
144 views
The difference between DDoS attacks in the cloud computing and the traditional network infrastructure [closed]
Is there any difference between the DDoS attack in the cloud computing and traditional network in infrastructure?
What are the important features for detection these types of attack in cloud ...
-5
votes
2answers
138 views
Intrusion detection in home security suites [closed]
Emsisoft announced that internet security has been removed from their product lineup and they stick with Windows firewall and "fortify" that ("blocks illegitimate manipulations of Windows Firewall ...
0
votes
1answer
68 views
How to configure Tiger security scanner
I'm running an Arch linux machine and want to run a scan using this tool called Tiger. I saw this video where the guy teaches to install it and run. In the video it ran normally after installed. In my ...
24
votes
4answers
3k views
Reduce Noise when Penetration Testing
Recently I participated in a capture the flag competition which was attached with SOC analysis teams monitoring our traffic.
There we were told that many tools were very noisy. Eg Sqlmap which has ...
1
vote
2answers
164 views
How to detect long lived SSH sessioned
I am trying to figure out a way to detect ssh sessions that have been established over a long period of time. I seem to recall that there were ways to detect tcp connections that have been connected ...
