Questions tagged [incident-analysis]
Analyzing what caused an event to be flagged as an incident
Is someone accessing my win10 computer?
I have been wondering if someone is accessing my system and after doing using some basic assessment tools like netstat and event viewer, found some unusual open ports(12345) and special Logon! below ...
Repeated DUP ACK and RST to same TCP SEQ and ACK
I started noticing this behaviour for more than a month. Whenever I connect my laptop to the WiFi router there are lots of RST and DUP ACKs up to the same TCP sequence, as given in the example below, ...
How to secure Laravel website against the ongoing massive exploitation
My website built upon Laravel is currently under attack. Only the index.php file was changed, and by that I mean that every line of code is inserted above the original Laravel code. So this code ...
Why are there so many special characters in this phishing link?
I recently looked at a spam mail I received. Generally, I'd say it was a fairly standard phishing attempt, but one thing struck me as odd: The link that victims are supposed to click looks very weird ...
Clonezilla for forensic disk image
I was wondering if it's reasonable and forensically correct to use Clonezilla for the image of an attacked machine. Since some of the commercial products are very expensive I'm turning to open source ...
Based on these HTTPS requests what type of attack is this?
I'm seeing over 1000 attempts to hit my API endpoints with many 500 responses. It seems clear that the would-be attacker is attempting to poke around the APIs, but it isn't clear to me what type of ...
Prevent a bot accessing login page with multiple IPs and massive list of username/ passwords
For the second time my website seems to be the target of a large automated attack. It seems complex enough and very well executed. I have the following systems in place: Captcha on 3rd failed login ...
Has this PC been hacked? What's going on?
I'm reasonably technically competent, but I don't know how to interpret this PC issue. As its a real-world incident, there's some back-story. I'm in the UK. The suspect PC runs Win8.1 up to date, ...
Suspicious calls to testgvbgjbhjb.com
On the last few days, one of our endpoints calls to testgvbgjbhjb.com the calls came from google chrome outside. I used TCPView to find suspicious connections and check if there any unknown ...
Under which conditions can dllhost.exe spawn child process? | MITRE ATT&CK T1191
I was looking for conditions/circumstances under which Dllhost.exe can spawn a child process. I examined a huge quantity of event logs from various Windows system and didn't come across any event in ...
Tools for reverse engineering malicious executables? [closed]
Are there any tools that one can reliably use for decompiling malicious executables in order to understand the inner workings of the same? Or any other reliable tool/way to quickly derive the code?
What use to automate incident response? [closed]
I am now read about TheHive Project - open source incident response platform. Today i asked developers about automatization of incidents, and find, that TheHive can't do this. Main feature for me is ...
read raw dump with WinDBG
Is it possible to convert a full raw dump memory and open it in WinDBG ? In order to inspect if they are no malwares, filter process who call particular API, dump each process in memory etc...
Incident response and recovery from a security breach with unknown attack vector
Security breaches, hacks, “cyber” attacks or server compromises happen quite frequently, unfortunately, such as Quora in December 2018, Facebook in September 2018, Equifax in September 2017, Exactis ...
Malware Author's Mindset
I'm studying common malware characteristics, and I'm having a bit of difficulty understanding the design choices the malware authors make. Many of said choices seem to revolve around making life ...
CSIRT Softwares [closed]
I'm wondering what kind of software Computer Security Emergency Response teams use to manage their work? For example to catalog incidents, responses and manage risks.
What is the difference between "Incident", "Attack" and "event"?
In the Computer and network security incident taxonomy what are the differences between "Incident", "Attack" and "event"? Where does "threat" fit with them?
Debian server invalid loging attempts and high bandwidth use
Since a couple of days ago my Debian server started to get login attempts (see log file below). /var/log/auth.log goes only three days back, although the server has been running for much longer. I ...
What are the most valuable information when handling an IT security event/incident?
I'm currently looking into reporting processes in information security and I was wondering what kind of information should be reported when an IT security event or incident occurs. The definitions of ...
Retrieve a deleted trojan by Kaspersky for analysis (on windows 7)?
After installation of Kaspersky on a windows machine, several trojan viruses where discovered and deleted. Now, I'm looking for a way to retreive those trojans deleted by kasperky. (to export them to ...
What's the Impact of the CloudFlare Reverse Proxy Bug? ("#CloudBleed")
In Project Zero #1139, it was disclosed that CloudFlare had a bug which disclosed uninitialized memory, leaking private data sent through them via SSL. What's the real impact?
Bizarre series of web errors from vulnerability scanner OpenVAS - is this malicious?
A short series of errors just came in from Elmah. They are very peculiar, and I'm unsure as to what they represent and whether they might be malicious. It amounted to a series of 16 sequential calls ...
Why VirtualBox Windows 7 guest machine is not supporting malware analysis [closed]
Recently, I downloaded some malware samples for incident response practice. Then I installed them in a VirtualBox Windows 7 guest machine, but they are not working properly. I disabled anti-virus ...
What skills will I need to learn for a 'Security Analyst' job role? [closed]
What skills will I need to learn for a 'Security Analyst' job role? By this, I mean someone who monitors the network to uncover compromised systems. I believe this is similar to working in a Blue ...
BlackHole Toolkit v2 JAVA Payload Stage Code Execution - What does this activity mean?! I cannot get hold of the owner of the server to check
An analyst came across this alert - BlackHole Toolkit v2 JAVA Payload Stage Code Execution from the Checkpoint IPS coming from a server, the event is recorded as a blocked outgoing connection attempt -...
Is there anyway to analyze memory dynamically?
I do malware analysis by using memory forensics to gather more useful information but as far as I know, the result of memory acquisition is just one memory dumped for a specific time (snapshot). So, ...
Accounts being accessed from X country
So recently I've been getting emails that X account has been accessed from Y country with an IP address that I obviously don't own. An example would be my Steam account which recently got accessed ...
Infrastructure for incident analysis
I have a security-critical online service. (API playground available here.) In case of a security incident I want proper infrastructure to analyse what went wrong. Should I make rolling captures of ...
Need some recommendations on good IR hands-on training [closed]
Does anyone know if there is any good hands-on training for incident response and digital forensics, or certification I need to take in order to gain more hands-on experience? Thanks and any helpful ...
How to analyze the netstat log for suspicious connections?
I found a question from here: http://www.activeresponse.org/20-questions-for-an-intrusion-analyst/ But not sure what its answer is. Here is the question and it asks me to find out all suspicious ...
Does this pdf file embeds an exploit or malware?
So a friend of mine was sent a phishing attack(Which was tailored for him and he fell for it) which also downloaded this pdf file: hxxps://www.dropbox.com/s/qw9mcw9p3pmc5j5/resume.pdf?dl=0 and he ...
What exactly does "Nation-State" code look like?
Juniper Networks has discovered unauthorized code that appears to be planted by a nation-state attacker in their firewalls. A similar claim was made about Stuxnet, Duqu, Flame, Gauss, and probably ...
How did someone log-in to my Gmail account from Kenya?
While on holiday in France in May I received an email from Google "New sign-in". Your Google Account was just used to sign in: Nairobi, Kenya. Tuesday, 26 May 2015 22:10 (East Africa Time). I ...
Definition of security incident [closed]
What's a security incident in information security? Can an unsuccessful attack (blocked by an IPS for instance) or an attack without real impact (a port scan for instance) be considered a security ...
attack on Unix procmail analysis
2 days ago I received the following E-mail (this is its original format not the one of any mailer, but where sensitive information is replaced by ••field_name••): From email@example.com Thu Jul 2 ...