Questions tagged [ids]
Intrusion Detection System, a system for detecting and alerting based on behavior.
0
votes
0answers
16 views
How to run a snort rule over PCAP file in Windows? [duplicate]
I have a PCAP file from CICIDS, and what I'd like to know is how can I apply the Snortrule in Windows? I've not written any custom rules myself but want to run the rules already available. For now, ...
0
votes
0answers
48 views
Snort rule for syn flood attacks - Limiting number of alerts
So I have a snort rule that detects syn flood attacks that looks like this:
alert tcp any any -> $HOME_NET 80 (msg:”SYN Flood - SSH"; flags:S;
flow: stateless; detection_filter: track by_dst, ...
34
votes
6answers
15k views
Is it possible to detect 100% of SQLi with a simple regex?
I'm wondering if it is possible to detect 100% of the possible SQLi attacks using a simple regex.
In other words, using very simple PHP code as an example:
if (preg_match("/select/i", $input)) {
...
1
vote
1answer
35 views
Multiple outbound TCP/8333 connections containing the EICAR test string
An IPS / IDS / UTM detects 50 connections from a single client containing Virus/Worm Eicar test string within half an hour. The destinations are IP addresses all around the world on port TCP/8333.
A ...
0
votes
0answers
36 views
Can an IDS be used for detecting frames (not packets) from an non-authenticated station
Can an IDS, like snort, be used to detect Layer 2 network frames from a system i.e a system is trying to send a frame to the AP and whether Snort can work on the frame based on the rules?
0
votes
1answer
46 views
Can Snort or Suricata *edit* packet on the fly?
I know that they can detect traffic by rules, but can they modify packets on the go?
For example, not only detecting HTTP GET but also adding headers to the GET packet.
If they can't, is there an ...
0
votes
1answer
57 views
intrusion prevention system detected “et policy pe exe” should i worry
I have a UniFi Security Gateway (USG Pro 4P) and just enabled IPS (intrusion prevention system). I am seeing many "ET POLICY PE EXE or DLL Windows file download HTTP" alerts. I have not been able to ...
1
vote
2answers
128 views
Windows process documentation for tuning Sysmon
I recently installed Sysmon, which logs events to OSSEC and currently monitors several endpoints. I have been trying to whitelist benign processes such as Windows services. Many of these processes run ...
1
vote
2answers
71 views
Is there any methodology to detect smart deauthentication attack?
I'm a project student in IIT-Hyderabad. I have been working in Wifi security domain for my M.Tech. In particular, I chose de-authentication attack.
Whenever I sent De-Auth frames continuously to APs ...
1
vote
2answers
458 views
How to connect a Raspberry Pi IDS to the home router to detect intrusions network wide?
I'm configuring a raspberry pi IDS/IPS with ELK stack on a separate machine, my problem is to connecting it to the router in a way it can read traffic on the whole network and drop the suspicious ...
1
vote
1answer
71 views
Chain of causality in Equifax breach (expired certificates disabling IPS capabilities)
I am researching the Equifax breach described here:
https://oversight.house.gov/wp-content/uploads/2018/12/Equifax-Report.pdf
Apparently the attack went undetected for a long period of time and the ...
1
vote
0answers
59 views
sandboxing IoCs and signatures
Sandboxes are used for automated extraction of indicators of compromise (IoCs) that can be used to write signatures. Can this signature then be used, for example, on an IPS system to block certain ...
3
votes
3answers
120 views
Should I block IP adresses that made attacks attempts and were block from an IPS through the rules?
We have an NIPS blocking attacks based on bad behaviors (rules checking the data in the network packets). Should I block the IP that the NIPS linked to attack attempts? It feels like the NIPS is ...
0
votes
0answers
45 views
Why would IPS vendor provider refuse to publish SLAs to fix the published highly ranked CVEs?
One of the biggest IPS providers (top of Gartner graph for its category) is not providing SLAs for all the 7+ ranking CVEs published last year. I don't really understand why would they refuse to ...
-2
votes
1answer
67 views
Penetration testing or Malware analysis? [closed]
My M.Sc research is about developing IDS for IOT.
I'm confused about which field should learn more about; penetration testing or malware analysis.
I have some knowledge about each one but for IDS, ...
0
votes
1answer
50 views
How likely is it to see a commercial IDS/IPS that uses machine learning in the near future that performs better than a normal IDS/IPS? [closed]
I have to choose a field to study on and I want to know does it worth studying in this field and will the future IDS/IPS systems be using machine-learning/deep-learning or at least how likely is it?
...
0
votes
1answer
344 views
IDS and IPS placement in network? [duplicate]
What is the good practice for the placement of IDS (NIDS) and IPS? Before the firewall or after the firewall? and why?
3
votes
2answers
238 views
How IDS and Firewall Logs are aggregated and feed aggregated log to SIEM?
I am studying SIEM tools.
Firewall logs will be different from IDS logs and even from Antivirus logs.
How can log aggregation take place?
1
vote
3answers
81 views
How useful is it to prevent Linux applications from setting up any untrusted connections, and can it be done easily?
Threat: your Linux machine gets compromised in some way (untrusted app, or compromised install package or update, or an app is compromised because of a vulnerability, etc.) and something on your ...
0
votes
1answer
149 views
Loopback with Suricata
Is there any way of analyzing loopback traffic with Suricata?
I am trying it this way without success:
root@security-onion:/home/sar/TFM/alerts/suricata# suricata -c /etc/suricata/suricata.yaml -i ...
0
votes
1answer
232 views
How can Insertion attack ever work and fool an IDS on a TCP connection?
An IDS can accept a packet that an end-system rejects. An IDS that does this makes the mistake of believing that the end-system has accepted and processed the packet when it actually hasn't. An ...
0
votes
0answers
158 views
snort rules are enabled by pulledpork but in the same time are skipped?
I am using pulledpork for management of rules. I had enabled rules from 1:1000 to 1:5735 those rules are enabled but in the same time are skipped.
As output I had:
https://github.com/shirkdog/...
1
vote
0answers
82 views
Snort not working with IDSWakeup
I have setup Snort with the registered user rules installed.
I tested first by making the following rule in local.rules:
alert icmp any any -> $HOME_NET any (msg:"ICMP test"; sid:10000001; rev:...
2
votes
0answers
207 views
How can I get Suricata to alert on 1 packet every time
I am trying to write a Suricata signature for testing purposes to alert every time it is triggered with a single PCAP file containing a single packet, but this is proving to be harder than I thought.
...
0
votes
1answer
742 views
Comparison between WAF and IPS/IDS
I would like to know the difference between WAF and IPS/IDS?
Can IPS/IDS handle an attack on a web application?
If there are differences functionally between the two applications, how they work ...
0
votes
0answers
27 views
0 dynamic rules read
I am running Snort as IDS in Security Onion and get this message: 0 Dynamic rules
All SO_RULES are loaded in snort.conf in the correct path.
25867 Snort rules read
23950 detection rules
...
2
votes
1answer
687 views
Suricata: nmap scan does not match rules
I am using suricata with emerging-scan.rules and other rules. The rules are loaded in the suricata.yaml, homenet and ext_net are configured correctly.
For testing detection of suricata I used nmap -...
4
votes
4answers
939 views
Benefit of using two network interfaces for intrusion detection system
What is the benefit of using two network interfaces (management interface and sniffing interface) for an IDS such as Snort? I have used a Snort IDS where it only used one network interface for both ...
1
vote
2answers
95 views
Could an IPS have blocked an attack on a vulnerable router/firewall?
Thinking about the recent news regarding SOHO routers vulnerable to the VPNFilter attack: https://arstechnica.com/information-technology/2018/05/fbi-tells-router-users-to-reboot-now-to-kill-malware-...
2
votes
1answer
791 views
How does IPS terminate/decrypt encrypted traffic?
With regards to IPS, I am not completely across how they are supposed to terminate or decrypt encrypted traffic? It makes absolutely sense to deploy them inline, but how is traffic supposed to be ...
3
votes
0answers
77 views
PS4 gift card online purchase asked for photo ID
I purchased ps4 gift card online and they asked for ID verification. Which I have to take a photo of my ID front and back and a selfie. Is that safe and can they do anything with this information? I ...
1
vote
0answers
110 views
Blind XSS being intercepted by Palo Alto Tech OPs
I am doing a penetration test and I have a form that accepts any input. Whenever a form is submitted, a message of "Thank you, you will be contacted shortly" appears.
Acunetix detected a blind XSS ...
0
votes
0answers
36 views
Calculating the score for Packet Header Anomaly Detection?
I am studying the algorithm PHAD (Packet Header Anomaly Detection) for IDS. I can't understand the principle of this algorithm. Can somebody give me a practical example for calculating the score?
3
votes
1answer
396 views
Examples of non signature based anti-malware/anti-virus programs, IDS, & system integrity scanners
All traditional anti-virus software uses signatures to detect known malware after it has been discovered by the software companies and added to the definitions. Heuristic definitions allow a piece ...
0
votes
1answer
221 views
With an IPS in place, do we really need firewalls?
I was reading the article "Do you need an IDS or IPS, or both?"
on TechTarget. While reading the author's explanation of IPS this question hit me.
If an IPS is a control tool that uses a set of ...
0
votes
0answers
361 views
Snort.log output as unreadable symbols
I have recently installed Snort IDS on Linux Ubuntu 16.04LTS (not server), after experimenting and testing configuration in VitualBox.
After installing and successfully validating the configuration ...
6
votes
3answers
236 views
Tripwire report shows modification dates from when I was on vacation with computer shutdown at home
Tripwire report shows modification dates from when I was on vacation with computer shutdown at home - how is this possible?
here is one of many examples:
Modified object name: /lib/x86_64-linux-gnu/...
2
votes
0answers
145 views
What is the best way to test my anomaly detection system?
I have an IDS (Intrusion Detection System) built in C and I need to test it with real traffic. It is an anomaly detection system, so I need to train it with normal traffic first.
The IDS that I built ...
-2
votes
1answer
167 views
Anomaly based IDS Vs Protocol state based IDS
Is there any difference between them? On google, I can find many description about anomaly based IDS. But I can not find any description about protocol state based IDS.
2
votes
0answers
26 views
How to make a succesful mimicry attack when normal clusters are very small?
Anomaly detection IDS, sometimes, are designed to prevent mimicry attacks.
After the algorithm has done the clustering, there might be few and small clusters. The attacker will have problems with ...
4
votes
2answers
1k views
What is the difference between an anti-virus and an IPS?
As I understand it, an intrusion protection system (IPS) detects anomalous behavior, does detection of protocol anomalies, and does signature filtering that blocks malware, DDoS, etc. An antivirus ...
1
vote
1answer
1k views
IDS Snort rule to catch Slow-Loris
I'm trying to write a rule to catch a Slow-Loris attack, this is what i have -
alert tcp any any -> any any (msg:"Possible Slow Loris attack"; classtype: denial-of-service; flow: to_server, ...
-1
votes
2answers
100 views
WAF/IDS detection question
I've been writing scripts to identify WAF's on websites, and have come across one that appears, A LOT.
The HTML always looks like this:
<title>403 Forbidden</title>
</head><...
0
votes
2answers
729 views
What do you call an antivirus that detects suspicious activity?
A traditional antivirus scans data at rest and data in transit for known virus signatures. (Where "virus" includes trojans, rootkits, et al.)
This does not help when defending against zero-days and ...
1
vote
2answers
480 views
Intrusion Detection System (IDS / IPS) useful for Linux home users?
Can an Intrusion Detection System or Intrusion Prevention System (IDS / IPS) increase the security of home users using Linux?
Or is an IDS / IPS even less useful than antivirus for Linux?
Is an IDS /...
2
votes
0answers
59 views
Challenges of modern implementations of Network “Time Travel” analysis
I was reading this paper about the creation of network "time machines". This paper has some interesting ideas but they're largely applied to "traditional" network environments.
What kind of ...
0
votes
1answer
575 views
Combine SNORT detection and log with active response OSSEC
As far as i know, NIDS implemented in Network layer and HIDS in Host-based layer, Is it possible for NIDS( for example: Snort or suricata ) log that will included in HIDS(for example: OSSEC) log too ? ...
2
votes
2answers
202 views
Can dual NIC Snort machine cause threats to bypass firewall?
I am thinking about building a Linux Snort machine that can listen to both WAN and LAN traffic.
Setup I am thinking about:
Snort computer with two NICs
One NIC connected to hub/tap outside firewall (...
1
vote
0answers
146 views
Identifying privilege escalation in OSSEC logs [closed]
I am working on an intrusion detection system which can prioritize and attribute the logs generated by OSSEC. So, how can I understand a privilege escalation case (or just the privileges a user has at ...
1
vote
0answers
97 views
Loki/Linux Personal Realtime IDS and/or IPS
In the old days i used to use firewall apps on windows that would have intrusion detection that would alert me while on my system and/or email. For instance, i would see a popup that says: "Warning: ...
