Questions tagged [incident-response]
The art of responding to incidents in an organized and thoughtful manner.
11
questions with no upvoted or accepted answers
4
votes
0answers
272 views
attack on Unix procmail analysis
2 days ago I received the following E-mail (this is its original format
not the one of any mailer, but where sensitive information is replaced by ••field_name••):
From qqqqqq@freemail.net Thu Jul 2 ...
2
votes
0answers
114 views
How to manually download an MMS without opening?
I'm looking into a potential Stagefright attack on an Android mobile (AOS 5.+). But since I'm not an expert on the subject, I fail to find a simple way to safely download the MMS for inspection. I was ...
1
vote
0answers
173 views
Volatility: Issue with analyzing Windows 10 and Server 2016 systems
I have been trying to use Volatility 2.6 to analyze memory dumps generated by DumpIt. I am experiencing an issue analyzing the memory dumps (all 4 GB in size) of two Windows 10 64 bit boxes (build ...
1
vote
0answers
230 views
Invalid certificate error appears on my web server for 10 minutes and then disappears
I have a raspberry pi that hosts a web server and has a DDNS registered through no-ip. I just had an issue connecting to my webserver because a certificate appeared to be installed on this server that ...
1
vote
0answers
569 views
Extract Outlook email attachments from memory
Does anyone know if there is a way to extract Outlook emails with attachments from memory? What I have tried is to use volatility to dump PST files from memory and then use libpff to recover the ...
1
vote
0answers
129 views
Is it suspicious that mail server sends traffic to Tor Exit node?
I am monitoring the outbound traffic from mail server through IDS and recently I observed there were some traffic sending to Tor Exit nodes from mail server, for example, IP 46.183.85.124. After doing ...
1
vote
0answers
516 views
SSH attempt blocked now ECDSA keys changed
Last night I had an external IP tried to access my server over SSH. The attempt was blocked as it failed to authorise in the number of times and time limit that I'd specified.
Doing a whois on the ip ...
0
votes
0answers
85 views
Under which conditions can dllhost.exe spawn child process? | MITRE ATT&CK T1191
I was looking for conditions/circumstances under which Dllhost.exe can spawn a child process. I examined a huge quantity of event logs from various Windows system and didn't come across any event in ...
0
votes
0answers
98 views
My mail server has seemingly been compromised, but I don't know how
We have a mail server on CPanel, and we added the company email accounts from CPanel. We use outlook as the email client.
When we send emails to the procurement department, the hacker gets a copy.
...
0
votes
0answers
965 views
Detection and attribution of a running attack toward US elections
Recently an attack based on booby trapped web servers was blocked by Microsoft through seizure of some of the known server names used in this attack.
This attack analysis was focused to defend US ...
0
votes
0answers
70 views
How user can change the tty information (related to CVE-2017-1000367)
Recently Red Hat fixed an important vulnerability in sudo:
https://access.redhat.com/security/cve/cve-2017-1000367
From the description:
A flaw was found in the way sudo parsed tty information ...
