Skip to main content
New
Stack Overflow Jobs powered by Indeed: A job site that puts thousands of tech jobs at your fingertips (U.S. only). Search jobs

Questions tagged [incident-response]

The art of responding to incidents in an organized and thoughtful manner.

Filter by
Sorted by
Tagged with
0 votes
0 answers
31 views

What does this payload mean? [closed]

My server was attacked recently and while going through the logs I found this payload 0x160x030x010x000xee0x010x000x000xea0x030x036{0xd80x12:R0xb3c0x86Ss0xbdI0xf50xc90xc6;.3Q0xf0O0x0e0xd50x880xcc0xe4)...
Caesar's user avatar
  • 1
1 vote
0 answers
71 views

Security Incident Response Tracking [closed]

Besides Security IR tracking & workflow that is available in SIEM platforms, what are other tools that can do this such as standalone products like ServiceNow SIR or Everbridge xmatters? I found ...
Scott's user avatar
  • 160
1 vote
2 answers
135 views

How to monitor for vulnerabilities across your company stack?

Let's say a software company XYZ is using a variety of 3rd party vendors - as an example, it could use: Lastpass as a company password manager; Azure B2C as the authentication framework for the ...
littlebobbytables's user avatar
0 votes
1 answer
246 views

Someone unknown accessed my server via ssh, what steps can I follow to learn more?

First I will admit this machine isn't particularly well secured. It has an ssh port open to the internet, it accepts password login, it's OS and packages are not particularly up to date. I know many ...
Enkarht Khani's user avatar
14 votes
1 answer
3k views

If a ransomware is currently encrypting my files, should I power off my computer?

I wondered what to do if there is a currently ongoing ransomware execution on my computer. Assuming that I'm "spotting" it while it is encrypting my files, should I power my computer off? I ...
Luhko's user avatar
  • 161
1 vote
0 answers
130 views

Is someone accessing my win10 computer?

I have been wondering if someone is accessing my system and after doing using some basic assessment tools like netstat and event viewer, found some unusual open ports(12345) and special Logon! below ...
M D's user avatar
  • 11
1 vote
0 answers
66 views

Is Hanbook for CSIRTs still relevant learning material today?

The question is pretty self-explanatory. Is this book relevant today considering it has been published some time ago? If anyone has read it could you answer what are some things that have changed and ...
Nikola's user avatar
  • 11
2 votes
0 answers
76 views

BPFDoor injection point and containment

How to determine BPFdoor entrypoint?I used following link to detect it on host https://blog.qualys.com/vulnerabilities-threat-research/2022/08/01/heres-a-simple-script-to-detect-the-stealthy-nation-...
Bilal3755's user avatar
4 votes
2 answers
2k views

Acceptably resolving a serious vulnerability disclosure

Hypothetical scenario: An organisation with users who rely on the service's zero knowledge cryptography has a vulnerability disclosure made to it from a research institution. There are multiple ...
Ali's user avatar
  • 61
0 votes
0 answers
89 views

Windows 10 Cybersecurity on Stand-Alone Computer

I have been asked to investigate what capabilities exist within Windows 10 where the environment for this system is isolated. I believe it would not be able to benefit from an enterprise security ...
Jim's user avatar
  • 255
0 votes
0 answers
718 views

What should I do after an attempted Mozi attack?

I was testing a small webpage using Django's built-in server. The webpage simply shows the IP of the visitor of the webpage, and prints the IP address in the terminal. The server is hosted on a Ubuntu ...
George Tian's user avatar
0 votes
1 answer
197 views

Security Tools - File Encryption vs Corruption

When security tools quarantine files, why do they tend to use encryption, rather than simple file corruption? The main goal of quarantining a file is to make it impossible to run on a system. This ...
pepperoni's user avatar
2 votes
1 answer
288 views

What is the difference between a SOC and a CSIRT?

So, from a summary of what I have found on the internet, a SOC collects information and the CSIRT makes conclusions based on that info. However, from what I see in labs/challenges websites like ...
Néstor Llop's user avatar
0 votes
1 answer
136 views

Which key questions to ask while vetting an incident response company?

If I ever suspect a security incident exceeding internal capacity & skill sets, my plan calls for outside professionals. In choosing a specific Company, I expect to expose the company to these ...
user258000's user avatar
1 vote
2 answers
1k views

Clonezilla for forensic disk image

I was wondering if it's reasonable and forensically correct to use Clonezilla for the image of an attacked machine. Since some of the commercial products are very expensive I'm turning to open source ...
Jack's user avatar
  • 11
3 votes
2 answers
189 views

Incident Response and when to consider an incident resolved

I am currently making amendments to an IR process and the topic of incident closure has come up. The organisation follows NIST and therefore their IR process has four phases: Preparation Detection &...
JLPH's user avatar
  • 107
4 votes
1 answer
238 views

Can/should I automatically report network break-in attempts?

For the last 15 years I've been using SpamCop to report the spam I receive. I do this because it sometimes results in spammers and the third-party machines they compromise getting shut down, at ...
Psychonaut's user avatar
1 vote
1 answer
219 views

How to investigate potential infected client workstation

In this case a central endpoint security or SIEM solution alerts on Indicators of Compromise on one client workstation in a Windows domain. Should there be an IT staff who has admin accounts (domain ...
atn1ght's user avatar
  • 13
21 votes
7 answers
7k views

Prevent a bot accessing login page with multiple IPs and massive list of username/ passwords

For the second time my website seems to be the target of a large automated attack. It seems complex enough and very well executed. I have the following systems in place: Captcha on 3rd failed login ...
contool's user avatar
  • 323
7 votes
4 answers
8k views

Where can I find an engineer who can examine an exe and verify its legitimacy? [closed]

We have an exe file that our members have been using. It was submitted to VirusTotal and it returned one red flag: How can we have the app evaluated by a 3rd party software engineer? And how likely ...
Neal's user avatar
  • 87
1 vote
1 answer
195 views

Do incident response plans include playbooks?

Do incident response plans include the playbooks or are the playbooks separate from the incident response plan?
yusuf's user avatar
  • 11
1 vote
1 answer
408 views

How should we respond to a root CA breach?

In the unlikely event that a root CA is breached (eg. Comodo, DigiNotar), how should people and companies respond? (Assume the people responding practice infosec & are aware of the problems of ...
ChocolateOverflow's user avatar
1 vote
2 answers
12k views

What should I do if I'm receiving Tiktok verification code even I don't use and have deleted the application in my android device?

What should I do if I'm receiving SMS on phone giving in verification code of TikTok app despite I have deleted and no longer use the application in my Android device? I got an international call ...
qwerty's user avatar
  • 11
0 votes
0 answers
2k views

Interpreting SSH information on Windows Event Viewer.... sshd: Did not receive identification string from ipaddress on port portnumber

I am currently reading through Windows Event Log (OpenSSH) looking at the artefacts created by an attack, I am trying to understand the meaning of certain notifications. A brute force attack was ...
C.Mann's user avatar
  • 73
0 votes
1 answer
239 views

Dealing with File Permissions from a Virtual Machine - Forensic Logical Acquisition

I am currently in the middle of operating an analysis on Autopsy of a virtual machine (VMware) that has been hacked. I have mounted the VM and I am acquiring the evidence from VMware to my physical ...
C.Mann's user avatar
  • 73
2 votes
1 answer
440 views

What forensics should be collected as part of an incident response plan on Windows 10?

I am in the process of creating an IRP that responds to system hacks. I have attacked the Windows 10 myself (victim machine), using Metasploit on Kali Linux software, where I managed to gain access ...
C.Mann's user avatar
  • 73
3 votes
1 answer
509 views

How to detect backdoor/root shells?

Let's assume I'm a user with root access to a machine and I'm a legit user. My machine/server runs Linux. I'm not very familiar with defensive security (I mainly practice offensive). Sometimes, ...
ChocolateOverflow's user avatar
0 votes
2 answers
662 views

DoD 52220.22-M (3 Pass wipe) and Virtual Machines

So my place of work, if you can tell by the title is either Gov or Mil, and we recently had a tech refresh where all of our workstations were replaced with VM's. We are running version VMWare Version ...
Tony's user avatar
  • 1
3 votes
1 answer
317 views

Alternative routes for Incident Response approach other than Windows Event Viewer?

I am in preparation of developing an Incident Response Plan for a computer that has been hacked (no malware installed, just a system hack). My plan is to analyse through Windows Event Viewer to try ...
C.Mann's user avatar
  • 73
1 vote
0 answers
3k views

Volatility: Issue with analyzing Windows 10 and Server 2016 systems

I have been trying to use Volatility 2.6 to analyze memory dumps generated by DumpIt. I am experiencing an issue analyzing the memory dumps (all 4 GB in size) of two Windows 10 64 bit boxes (build ...
synthesis's user avatar
  • 155
1 vote
0 answers
196 views

Some questions regarding Red Hat Linux and a case study [closed]

As part of a course I'm doing, it's presented a case study. I'm a bit stuck and not too sure where to find further info. If someone could point me in the direction, I'd appreciate it. In this case ...
Ian's user avatar
  • 11
1 vote
1 answer
228 views

Can a forwarding rule be set on Outlook that will not be visible on office365/exchange admin interface?

In an incident concerning a user's mailbox - will any rule that forwards emails to a potential attack be visible in the office365/exchange admin interface, or is it possible to set an outlook client-...
user219205's user avatar
0 votes
2 answers
170 views

Incident response to a medium scale phishing attack whereas the targets are not from our company?

Our company suffered a phishing attack yesterday. While investigating about the attacker and the potential employees of ours who might have been phished, we ended up with the attacker database of ...
Xavier59's user avatar
  • 2,904
0 votes
3 answers
808 views

Under which conditions can dllhost.exe spawn child process? | MITRE ATT&CK T1191

I was looking for conditions/circumstances under which Dllhost.exe can spawn a child process. I examined a huge quantity of event logs from various Windows system and didn't come across any event in ...
pinpwn's user avatar
  • 1
0 votes
1 answer
169 views

Tools for reverse engineering malicious executables? [closed]

Are there any tools that one can reliably use for decompiling malicious executables in order to understand the inner workings of the same? Or any other reliable tool/way to quickly derive the code?
Student for Life's user avatar
-1 votes
2 answers
705 views

Pure-ftpd connections from unknown IPs

I'm seeing unknown IPs in results like this in the messages log on a CentOS 6 webserver, are these IPs actually accessing the machine? Mar 13 19:11:49 server pure-ftpd: ([email protected]) [INFO] New ...
goblin_rocket's user avatar
4 votes
1 answer
378 views

a mysterious & pointless long-term hacking attempt?

It seems that I am the target of a mysterious ongoing hacking attempt. I have several domain names, most of which are currently parked & pointed at a single ‘main’ website. For the last couple ...
ƬƦƖƝƛ's user avatar
2 votes
3 answers
534 views

Confusing terminologies: Incident, alert, event, ticket [duplicate]

I am doing research on Security orchestration and automation response (SOAR) and three above terminologies make me very confused. We are currently following the workflow like: some security events ...
Long DTVN's user avatar
0 votes
0 answers
249 views

My mail server has seemingly been compromised, but I don't know how

We have a mail server on CPanel, and we added the company email accounts from CPanel. We use outlook as the email client. When we send emails to the procurement department, the hacker gets a copy. ...
Dr Deo's user avatar
  • 101
1 vote
3 answers
401 views

What use to automate incident response? [closed]

I am now read about TheHive Project - open source incident response platform. Today i asked developers about automatization of incidents, and find, that TheHive can't do this. Main feature for me is ...
Gudsaf's user avatar
  • 121
1 vote
1 answer
306 views

Persistent Bootable USB with Write Protection?

I am developing a series of extraction scripts (currently python 2.7) for a university project - these tools will be provided on a bootable USB for use by first responders when encountering a suspect ...
Ryan Hodgson's user avatar
4 votes
5 answers
900 views

Incident response and recovery from a security breach with unknown attack vector

Security breaches, hacks, “cyber” attacks or server compromises happen quite frequently, unfortunately, such as Quora in December 2018, Facebook in September 2018, Equifax in September 2017, Exactis ...
caw's user avatar
  • 229
63 votes
5 answers
17k views

Can Beehive detect a Snowden-like actor?

In a seminar, one of the Authors of Beehive: Large-Scale Log Analysis for Detecting Suspicious Activity in Enterprise Networks said that this system can prevent actions like Snowden did. From their ...
kelalaka's user avatar
  • 5,559
27 votes
4 answers
10k views

I detected someone probing my site for weaknesses, what can I do about it? [duplicate]

My site has been getting probed by a bunch of IPs from Morroco (trying to submit forms, trying out potential URLs, trying to execute scripts etc..), I have a strong suspicion it's the same person ...
Jad S's user avatar
  • 393
1 vote
2 answers
515 views

Remote code execution and XSS vulnerabilities. What steps should be taken to secure a server once these are discovered and patched?

I've just been notified of a remote code execution vulnerability and an xss vulnerability on a site that I run. I've fixed the responsible code, but I'm wondering what steps should be taken afterwards ...
Mark Brown's user avatar
0 votes
1 answer
137 views

How to recover disk image from a smartphone in "bootloop" state?

I've been playing around on data recovery from devices and so far it worked well. Now I got this new situation that I don't know how to proceed in order to put my hands on the data. My old smartphone ...
Fnr's user avatar
  • 206
0 votes
0 answers
1k views

Detection and attribution of a running attack toward US elections

Recently an attack based on booby trapped web servers was blocked by Microsoft through seizure of some of the known server names used in this attack. This attack analysis was focused to defend US ...
dan's user avatar
  • 3,058
3 votes
1 answer
129 views

Methodology for finding existing adversary presence on network

A technology company starts small in the early 90's and, for various reasons, blows up into a multi-million dollar company in a very short time around 2013. The problem is that this company is ...
DocSpiegel's user avatar
0 votes
1 answer
202 views

CSIRT Softwares [closed]

I'm wondering what kind of software Computer Security Emergency Response teams use to manage their work? For example to catalog incidents, responses and manage risks.
Daniel Oliveira's user avatar
2 votes
1 answer
875 views

Use Splunk to run Nmap scan from remote host to potential attacker

When receiving internal attacks, I'd like to utilize Splunk alerts to trigger an Nmap scan against that attacking host from a remote machine; one other than the Splunk server. Is there any API or ...
SnakeItUp's user avatar

1
2 3 4 5