Questions tagged [incident-analysis]
Analyzing what caused an event to be flagged as an incident
35
questions
1
vote
0
answers
78
views
Is someone accessing my win10 computer?
I have been wondering if someone is accessing my system and after doing using some basic assessment tools like netstat and event viewer, found some unusual open ports(12345) and special Logon! below ...
- 11
1
vote
1
answer
236
views
Repeated DUP ACK and RST to same TCP SEQ and ACK
I started noticing this behaviour for more than a month. Whenever I connect my laptop to the WiFi router there are lots of RST and DUP ACKs up to the same TCP sequence, as given in the example below, ...
- 11
0
votes
1
answer
266
views
How to secure Laravel website against the ongoing massive exploitation
My website built upon Laravel is currently under attack.
Only the index.php file was changed, and by that I mean that every line of code is inserted above the original Laravel code. So this code ...
0
votes
2
answers
318
views
Why are there so many special characters in this phishing link?
I recently looked at a spam mail I received. Generally, I'd say it was a fairly standard phishing attempt, but one thing struck me as odd:
The link that victims are supposed to click looks very weird ...
- 101
1
vote
2
answers
648
views
Clonezilla for forensic disk image
I was wondering if it's reasonable and forensically correct to use Clonezilla for the image of an attacked machine.
Since some of the commercial products are very expensive I'm turning to open source ...
- 11
2
votes
1
answer
232
views
Based on these HTTPS requests what type of attack is this?
I'm seeing over 1000 attempts to hit my API endpoints with many 500 responses. It seems clear that the would-be attacker is attempting to poke around the APIs, but it isn't clear to me what type of ...
- 438
20
votes
7
answers
6k
views
Prevent a bot accessing login page with multiple IPs and massive list of username/ passwords
For the second time my website seems to be the target of a large automated attack. It seems complex enough and very well executed. I have the following systems in place:
Captcha on 3rd failed login ...
- 313
0
votes
0
answers
167
views
Has this PC been hacked? What's going on?
I'm reasonably technically competent, but I don't know how to interpret this PC issue. As its a real-world incident, there's some back-story.
I'm in the UK. The suspect PC runs Win8.1 up to date, ...
- 1,674
2
votes
2
answers
4k
views
Suspicious calls to testgvbgjbhjb.com
On the last few days, one of our endpoints calls to testgvbgjbhjb.com
the calls came from google chrome outside.
I used TCPView to find suspicious connections and check if there any unknown
...
- 151
0
votes
2
answers
598
views
Under which conditions can dllhost.exe spawn child process? | MITRE ATT&CK T1191
I was looking for conditions/circumstances under which Dllhost.exe can spawn a child process. I examined a huge quantity of event logs from various Windows system and didn't come across any event in ...
- 1
0
votes
1
answer
144
views
Tools for reverse engineering malicious executables? [closed]
Are there any tools that one can reliably use for decompiling malicious executables in order to understand the inner workings of the same? Or any other reliable tool/way to quickly derive the code?
1
vote
3
answers
352
views
What use to automate incident response? [closed]
I am now read about TheHive Project - open source incident response platform.
Today i asked developers about automatization of incidents, and find, that TheHive can't do this.
Main feature for me is ...
- 121
0
votes
1
answer
2k
views
read raw dump with WinDBG
Is it possible to convert a full raw dump memory and open it in WinDBG ? In order to inspect if they are no malwares, filter process who call particular API, dump each process in memory etc...
4
votes
5
answers
847
views
Incident response and recovery from a security breach with unknown attack vector
Security breaches, hacks, “cyber” attacks or server compromises happen quite frequently, unfortunately, such as Quora in December 2018, Facebook in September 2018, Equifax in September 2017, Exactis ...
- 199
3
votes
2
answers
388
views
Malware Author's Mindset
I'm studying common malware characteristics, and I'm having a bit of difficulty understanding the design choices the malware authors make. Many of said choices seem to revolve around making life ...
0
votes
1
answer
177
views
CSIRT Softwares [closed]
I'm wondering what kind of software Computer Security Emergency Response teams use to manage their work? For example to catalog incidents, responses and manage risks.
18
votes
3
answers
8k
views
What is the difference between "Incident", "Attack" and "event"?
In the Computer and network security incident taxonomy what are the differences between "Incident", "Attack" and "event"? Where does "threat" fit with them?
- 527
0
votes
4
answers
903
views
Debian server invalid loging attempts and high bandwidth use
Since a couple of days ago my Debian server started to get login attempts (see log file below). /var/log/auth.log goes only three days back, although the server has been running for much longer.
I ...
- 1
6
votes
1
answer
445
views
What are the most valuable information when handling an IT security event/incident?
I'm currently looking into reporting processes in information security and I was wondering what kind of information should be reported when an IT security event or incident occurs.
The definitions of ...
- 7,945
0
votes
1
answer
85
views
Retrieve a deleted trojan by Kaspersky for analysis (on windows 7)?
After installation of Kaspersky on a windows machine, several trojan viruses where discovered and deleted.
Now, I'm looking for a way to retreive those trojans deleted by kasperky. (to export them to ...
- 31
59
votes
1
answer
4k
views
What's the Impact of the CloudFlare Reverse Proxy Bug? ("#CloudBleed")
In Project Zero #1139, it was disclosed that CloudFlare had a bug which disclosed uninitialized memory, leaking private data sent through them via SSL. What's the real impact?
- 38.2k
2
votes
1
answer
2k
views
Bizarre series of web errors from vulnerability scanner OpenVAS - is this malicious?
A short series of errors just came in from Elmah. They are very peculiar, and I'm unsure as to what they represent and whether they might be malicious.
It amounted to a series of 16 sequential calls ...
- 549
0
votes
2
answers
211
views
Why VirtualBox Windows 7 guest machine is not supporting malware analysis [closed]
Recently, I downloaded some malware samples for incident response practice. Then I installed them in a VirtualBox Windows 7 guest machine, but they are not working properly.
I disabled anti-virus ...
- 231
1
vote
2
answers
1k
views
What skills will I need to learn for a 'Security Analyst' job role? [closed]
What skills will I need to learn for a 'Security Analyst' job role?
By this, I mean someone who monitors the network to uncover compromised systems.
I believe this is similar to working in a Blue ...
3
votes
3
answers
217
views
BlackHole Toolkit v2 JAVA Payload Stage Code Execution - What does this activity mean?! I cannot get hold of the owner of the server to check
An analyst came across this alert - BlackHole Toolkit v2 JAVA Payload Stage Code Execution from the Checkpoint IPS coming from a server, the event is recorded as a blocked outgoing connection attempt -...
- 31
5
votes
2
answers
119
views
Is there anyway to analyze memory dynamically?
I do malware analysis by using memory forensics to gather more useful information but as far as I know, the result of memory acquisition is just one memory dumped for a specific time (snapshot). So, ...
- 167
2
votes
1
answer
160
views
Accounts being accessed from X country
So recently I've been getting emails that X account has been accessed from Y country with an IP address that I obviously don't own. An example would be my Steam account which recently got accessed ...
- 900
2
votes
1
answer
87
views
Infrastructure for incident analysis
I have a security-critical online service. (API playground available here.) In case of a security incident I want proper infrastructure to analyse what went wrong.
Should I make rolling captures of ...
- 1,715
4
votes
3
answers
314
views
Need some recommendations on good IR hands-on training [closed]
Does anyone know if there is any good hands-on training for incident response and digital forensics, or certification I need to take in order to gain more hands-on experience? Thanks and any helpful ...
- 439
2
votes
3
answers
16k
views
How to analyze the netstat log for suspicious connections?
I found a question from here: http://www.activeresponse.org/20-questions-for-an-intrusion-analyst/
But not sure what its answer is. Here is the question and it asks me to find out all suspicious ...
- 439
1
vote
0
answers
288
views
Does this pdf file embeds an exploit or malware?
So a friend of mine was sent a phishing attack(Which was tailored for him and he fell for it) which also downloaded this pdf file: hxxps://www.dropbox.com/s/qw9mcw9p3pmc5j5/resume.pdf?dl=0 and he ...
9
votes
2
answers
283
views
What exactly does "Nation-State" code look like?
Juniper Networks has discovered unauthorized code that appears to be planted by a nation-state attacker in their firewalls.
A similar claim was made about Stuxnet, Duqu, Flame, Gauss, and probably ...
- 762
87
votes
2
answers
19k
views
How did someone log-in to my Gmail account from Kenya?
While on holiday in France in May I received an email from Google "New sign-in".
Your Google Account was just used to sign in:
Nairobi, Kenya. Tuesday, 26 May 2015 22:10 (East Africa Time).
I ...
- 2,144
0
votes
1
answer
306
views
Definition of security incident [closed]
What's a security incident in information security?
Can an unsuccessful attack (blocked by an IPS for instance) or an attack without real impact (a port scan for instance) be considered a security ...
- 577
4
votes
0
answers
350
views
attack on Unix procmail analysis
2 days ago I received the following E-mail (this is its original format
not the one of any mailer, but where sensitive information is replaced by ••field_name••):
From qqqqqq@freemail.net Thu Jul 2 ...
- 3,028