Questions tagged [incident-analysis]

Analyzing what caused an event to be flagged as an incident

Filter by
Sorted by
Tagged with
0 votes
1 answer
30 views

Repeated DUP ACK and RST to same TCP SEQ and ACK

I started noticing this behaviour for more than a month. Whenever I connect my laptop to the WiFi router there are lots of RST and DUP ACKs up to the same TCP sequence, as given in the example below, ...
user avatar
0 votes
1 answer
214 views

How to secure Laravel website against the ongoing massive exploitation

My website built upon Laravel is currently under attack. Only the index.php file was changed, and by that I mean that every line of code is inserted above the original Laravel code. So this code ...
user avatar
0 votes
2 answers
258 views

Why are there so many special characters in this phishing link?

I recently looked at a spam mail I received. Generally, I'd say it was a fairly standard phishing attempt, but one thing struck me as odd: The link that victims are supposed to click looks very weird ...
user avatar
1 vote
2 answers
327 views

Clonezilla for forensic disk image

I was wondering if it's reasonable and forensically correct to use Clonezilla for the image of an attacked machine. Since some of the commercial products are very expensive I'm turning to open source ...
user avatar
  • 11
1 vote
1 answer
187 views

Based on these HTTPS requests what type of attack is this?

I'm seeing over 1000 attempts to hit my API endpoints with many 500 responses. It seems clear that the would-be attacker is attempting to poke around the APIs, but it isn't clear to me what type of ...
user avatar
20 votes
7 answers
5k views

Prevent a bot accessing login page with multiple IPs and massive list of username/ passwords

For the second time my website seems to be the target of a large automated attack. It seems complex enough and very well executed. I have the following systems in place: Captcha on 3rd failed login ...
user avatar
  • 313
0 votes
0 answers
163 views

Has this PC been hacked? What's going on?

I'm reasonably technically competent, but I don't know how to interpret this PC issue. As its a real-world incident, there's some back-story. I'm in the UK. The suspect PC runs Win8.1 up to date, ...
user avatar
  • 1,664
2 votes
2 answers
3k views

Suspicious calls to testgvbgjbhjb.com

On the last few days, one of our endpoints calls to testgvbgjbhjb.com the calls came from google chrome outside. I used TCPView to find suspicious connections and check if there any unknown ...
user avatar
  • 151
0 votes
2 answers
416 views

Under which conditions can dllhost.exe spawn child process? | MITRE ATT&CK T1191

I was looking for conditions/circumstances under which Dllhost.exe can spawn a child process. I examined a huge quantity of event logs from various Windows system and didn't come across any event in ...
user avatar
  • 1
0 votes
1 answer
138 views

Tools for reverse engineering malicious executables? [closed]

Are there any tools that one can reliably use for decompiling malicious executables in order to understand the inner workings of the same? Or any other reliable tool/way to quickly derive the code?
user avatar
1 vote
3 answers
339 views

What use to automate incident response? [closed]

I am now read about TheHive Project - open source incident response platform. Today i asked developers about automatization of incidents, and find, that TheHive can't do this. Main feature for me is ...
user avatar
  • 121
0 votes
1 answer
2k views

read raw dump with WinDBG

Is it possible to convert a full raw dump memory and open it in WinDBG ? In order to inspect if they are no malwares, filter process who call particular API, dump each process in memory etc...
user avatar
4 votes
5 answers
827 views

Incident response and recovery from a security breach with unknown attack vector

Security breaches, hacks, “cyber” attacks or server compromises happen quite frequently, unfortunately, such as Quora in December 2018, Facebook in September 2018, Equifax in September 2017, Exactis ...
user avatar
  • 199
3 votes
2 answers
359 views

Malware Author's Mindset

I'm studying common malware characteristics, and I'm having a bit of difficulty understanding the design choices the malware authors make. Many of said choices seem to revolve around making life ...
user avatar
0 votes
1 answer
174 views

CSIRT Softwares [closed]

I'm wondering what kind of software Computer Security Emergency Response teams use to manage their work? For example to catalog incidents, responses and manage risks.
user avatar
18 votes
3 answers
8k views

What is the difference between "Incident", "Attack" and "event"?

In the Computer and network security incident taxonomy what are the differences between "Incident", "Attack" and "event"? Where does "threat" fit with them?
user avatar
  • 517
0 votes
4 answers
793 views

Debian server invalid loging attempts and high bandwidth use

Since a couple of days ago my Debian server started to get login attempts (see log file below). /var/log/auth.log goes only three days back, although the server has been running for much longer. I ...
user avatar
  • 1
6 votes
1 answer
426 views

What are the most valuable information when handling an IT security event/incident?

I'm currently looking into reporting processes in information security and I was wondering what kind of information should be reported when an IT security event or incident occurs. The definitions of ...
user avatar
  • 7,913
0 votes
1 answer
84 views

Retrieve a deleted trojan by Kaspersky for analysis (on windows 7)?

After installation of Kaspersky on a windows machine, several trojan viruses where discovered and deleted. Now, I'm looking for a way to retreive those trojans deleted by kasperky. (to export them to ...
user avatar
59 votes
1 answer
4k views

What's the Impact of the CloudFlare Reverse Proxy Bug? ("#CloudBleed")

In Project Zero #1139, it was disclosed that CloudFlare had a bug which disclosed uninitialized memory, leaking private data sent through them via SSL. What's the real impact?
user avatar
  • 38.1k
2 votes
1 answer
2k views

Bizarre series of web errors from vulnerability scanner OpenVAS - is this malicious?

A short series of errors just came in from Elmah. They are very peculiar, and I'm unsure as to what they represent and whether they might be malicious. It amounted to a series of 16 sequential calls ...
user avatar
  • 549
0 votes
2 answers
208 views

Why VirtualBox Windows 7 guest machine is not supporting malware analysis [closed]

Recently, I downloaded some malware samples for incident response practice. Then I installed them in a VirtualBox Windows 7 guest machine, but they are not working properly. I disabled anti-virus ...
user avatar
  • 231
1 vote
2 answers
1k views

What skills will I need to learn for a 'Security Analyst' job role? [closed]

What skills will I need to learn for a 'Security Analyst' job role? By this, I mean someone who monitors the network to uncover compromised systems. I believe this is similar to working in a Blue ...
user avatar
3 votes
3 answers
211 views

BlackHole Toolkit v2 JAVA Payload Stage Code Execution - What does this activity mean?! I cannot get hold of the owner of the server to check

An analyst came across this alert - BlackHole Toolkit v2 JAVA Payload Stage Code Execution from the Checkpoint IPS coming from a server, the event is recorded as a blocked outgoing connection attempt -...
user avatar
  • 31
5 votes
2 answers
119 views

Is there anyway to analyze memory dynamically?

I do malware analysis by using memory forensics to gather more useful information but as far as I know, the result of memory acquisition is just one memory dumped for a specific time (snapshot). So, ...
user avatar
  • 167
2 votes
1 answer
150 views

Accounts being accessed from X country

So recently I've been getting emails that X account has been accessed from Y country with an IP address that I obviously don't own. An example would be my Steam account which recently got accessed ...
user avatar
  • 910
2 votes
1 answer
86 views

Infrastructure for incident analysis

I have a security-critical online service. (API playground available here.) In case of a security incident I want proper infrastructure to analyse what went wrong. Should I make rolling captures of ...
user avatar
  • 1,675
4 votes
3 answers
312 views

Need some recommendations on good IR hands-on training [closed]

Does anyone know if there is any good hands-on training for incident response and digital forensics, or certification I need to take in order to gain more hands-on experience? Thanks and any helpful ...
user avatar
  • 439
2 votes
3 answers
14k views

How to analyze the netstat log for suspicious connections?

I found a question from here: http://www.activeresponse.org/20-questions-for-an-intrusion-analyst/ But not sure what its answer is. Here is the question and it asks me to find out all suspicious ...
user avatar
  • 439
1 vote
0 answers
265 views

Does this pdf file embeds an exploit or malware?

So a friend of mine was sent a phishing attack(Which was tailored for him and he fell for it) which also downloaded this pdf file: hxxps://www.dropbox.com/s/qw9mcw9p3pmc5j5/resume.pdf?dl=0 and he ...
user avatar
9 votes
2 answers
279 views

What exactly does "Nation-State" code look like?

Juniper Networks has discovered unauthorized code that appears to be planted by a nation-state attacker in their firewalls. A similar claim was made about Stuxnet, Duqu, Flame, Gauss, and probably ...
user avatar
87 votes
2 answers
19k views

How did someone log-in to my Gmail account from Kenya?

While on holiday in France in May I received an email from Google "New sign-in". Your Google Account was just used to sign in: Nairobi, Kenya. Tuesday, 26 May 2015 22:10 (East Africa Time). I ...
user avatar
0 votes
1 answer
303 views

Definition of security incident [closed]

What's a security incident in information security? Can an unsuccessful attack (blocked by an IPS for instance) or an attack without real impact (a port scan for instance) be considered a security ...
user avatar
  • 587
4 votes
0 answers
346 views

attack on Unix procmail analysis

2 days ago I received the following E-mail (this is its original format not the one of any mailer, but where sensitive information is replaced by ••field_name••): From qqqqqq@freemail.net Thu Jul 2 ...
user avatar
  • 3,033