Questions tagged [incident-analysis]

Analyzing what caused an event to be flagged as an incident

Filter by
Sorted by
Tagged with
0
votes
0answers
33 views

Under which conditions can dllhost.exe spawn child process? | MITRE ATT&CK T1191

I was looking for conditions/circumstances under which Dllhost.exe can spawn a child process. I examined a huge quantity of event logs from various Windows system and didn't come across any event in ...
0
votes
1answer
89 views

Tools for reverse engineering malicious executables? [closed]

Are there any tools that one can reliably use for decompiling malicious executables in order to understand the inner workings of the same? Or any other reliable tool/way to quickly derive the code?
1
vote
3answers
112 views

What use to automate incident response? [closed]

I am now read about TheHive Project - open source incident response platform. Today i asked developers about automatization of incidents, and find, that TheHive can't do this. Main feature for me is ...
0
votes
1answer
193 views

read raw dump with WinDBG

Is it possible to convert a full raw dump memory and open it in WinDBG ? In order to inspect if they are no malwares, filter process who call particular API, dump each process in memory etc...
5
votes
5answers
662 views

Incident response and recovery from a security breach with unknown attack vector

Security breaches, hacks, “cyber” attacks or server compromises happen quite frequently, unfortunately, such as Quora in December 2018, Facebook in September 2018, Equifax in September 2017, Exactis ...
3
votes
2answers
212 views

Malware Author's Mindset

I'm studying common malware characteristics, and I'm having a bit of difficulty understanding the design choices the malware authors make. Many of said choices seem to revolve around making life ...
0
votes
1answer
86 views

CSIRT Softwares [closed]

I'm wondering what kind of software Computer Security Emergency Response teams use to manage their work? For example to catalog incidents, responses and manage risks.
19
votes
3answers
6k views

What is the difference between “Incident”, “Attack” and “event”?

In the Computer and network security incident taxonomy what are the differences between "Incident", "Attack" and "event"? Where does "threat" fit with them?
0
votes
4answers
433 views

Debian server invalid loging attempts and high bandwidth use

Since a couple of days ago my Debian server started to get login attempts (see log file below). /var/log/auth.log goes only three days back, although the server has been running for much longer. I ...
6
votes
1answer
342 views

What are the most valuable information when handling an IT security event/incident?

I'm currently looking into reporting processes in information security and I was wondering what kind of information should be reported when an IT security event or incident occurs. The definitions of ...
0
votes
1answer
47 views

Retrieve a deleted trojan by Kaspersky for analysis (on windows 7)?

After installation of Kaspersky on a windows machine, several trojan viruses where discovered and deleted. Now, I'm looking for a way to retreive those trojans deleted by kasperky. (to export them to ...
59
votes
1answer
4k views

What's the Impact of the CloudFlare Reverse Proxy Bug? (“#CloudBleed”)

In Project Zero #1139, it was disclosed that CloudFlare had a bug which disclosed uninitialized memory, leaking private data sent through them via SSL. What's the real impact?
2
votes
1answer
1k views

Bizarre series of web errors from vulnerability scanner OpenVAS - is this malicious?

A short series of errors just came in from Elmah. They are very peculiar, and I'm unsure as to what they represent and whether they might be malicious. It amounted to a series of 16 sequential calls ...
0
votes
2answers
161 views

Why VirtualBox Windows 7 guest machine is not supporting malware analysis [closed]

Recently, I downloaded some malware samples for incident response practice. Then I installed them in a VirtualBox Windows 7 guest machine, but they are not working properly. I disabled anti-virus ...
1
vote
2answers
910 views

What skills will I need to learn for a 'Security Analyst' job role? [closed]

What skills will I need to learn for a 'Security Analyst' job role? By this, I mean someone who monitors the network to uncover compromised systems. I believe this is similar to working in a Blue ...
3
votes
3answers
141 views

BlackHole Toolkit v2 JAVA Payload Stage Code Execution - What does this activity mean?! I cannot get hold of the owner of the server to check

An analyst came across this alert - BlackHole Toolkit v2 JAVA Payload Stage Code Execution from the Checkpoint IPS coming from a server, the event is recorded as a blocked outgoing connection attempt -...
5
votes
2answers
78 views

Is there anyway to analyze memory dynamically?

I do malware analysis by using memory forensics to gather more useful information but as far as I know, the result of memory acquisition is just one memory dumped for a specific time (snapshot). So, ...
2
votes
1answer
95 views

Accounts being accessed from X country

So recently I've been getting emails that X account has been accessed from Y country with an IP address that I obviously don't own. An example would be my Steam account which recently got accessed ...
2
votes
1answer
44 views

Infrastructure for incident analysis

I have a security-critical online service. (API playground available here.) In case of a security incident I want proper infrastructure to analyse what went wrong. Should I make rolling captures of ...
4
votes
3answers
228 views

Need some recommendations on good IR hands-on training [closed]

Does anyone know if there is any good hands-on training for incident response and digital forensics, or certification I need to take in order to gain more hands-on experience? Thanks and any helpful ...
1
vote
3answers
8k views

How to analyze the netstat log for suspicious connections?

I found a question from here: http://www.activeresponse.org/20-questions-for-an-intrusion-analyst/ But not sure what its answer is. Here is the question and it asks me to find out all suspicious ...
1
vote
0answers
177 views

Does this pdf file embeds an exploit or malware?

So a friend of mine was sent a phishing attack(Which was tailored for him and he fell for it) which also downloaded this pdf file: hxxps://www.dropbox.com/s/qw9mcw9p3pmc5j5/resume.pdf?dl=0 and he ...
10
votes
2answers
230 views

What exactly does “Nation-State” code look like?

Juniper Networks has discovered unauthorized code that appears to be planted by a nation-state attacker in their firewalls. A similar claim was made about Stuxnet, Duqu, Flame, Gauss, and probably ...
84
votes
2answers
16k views

How did someone log-in to my Gmail account from Kenya?

While on holiday in France in May I received an email from Google "New sign-in". Your Google Account was just used to sign in: Nairobi, Kenya. Tuesday, 26 May 2015 22:10 (East Africa Time). I ...
0
votes
1answer
251 views

Definition of security incident [closed]

What's a security incident in information security? Can an unsuccessful attack (blocked by an IPS for instance) or an attack without real impact (a port scan for instance) be considered a security ...
4
votes
0answers
269 views

attack on Unix procmail analysis

2 days ago I received the following E-mail (this is its original format not the one of any mailer, but where sensitive information is replaced by ••field_name••): From qqqqqq@freemail.net Thu Jul 2 ...