A message from our CEO about the future of Stack Overflow and Stack Exchange. Read now.

Questions tagged [incident-response]

The art of responding to incidents in an organized and thoughtful manner.

11 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
4
votes
0answers
272 views

attack on Unix procmail analysis

2 days ago I received the following E-mail (this is its original format not the one of any mailer, but where sensitive information is replaced by ••field_name••): From qqqqqq@freemail.net Thu Jul 2 ...
2
votes
0answers
114 views

How to manually download an MMS without opening?

I'm looking into a potential Stagefright attack on an Android mobile (AOS 5.+). But since I'm not an expert on the subject, I fail to find a simple way to safely download the MMS for inspection. I was ...
1
vote
0answers
173 views

Volatility: Issue with analyzing Windows 10 and Server 2016 systems

I have been trying to use Volatility 2.6 to analyze memory dumps generated by DumpIt. I am experiencing an issue analyzing the memory dumps (all 4 GB in size) of two Windows 10 64 bit boxes (build ...
1
vote
0answers
230 views

Invalid certificate error appears on my web server for 10 minutes and then disappears

I have a raspberry pi that hosts a web server and has a DDNS registered through no-ip. I just had an issue connecting to my webserver because a certificate appeared to be installed on this server that ...
1
vote
0answers
569 views

Extract Outlook email attachments from memory

Does anyone know if there is a way to extract Outlook emails with attachments from memory? What I have tried is to use volatility to dump PST files from memory and then use libpff to recover the ...
1
vote
0answers
129 views

Is it suspicious that mail server sends traffic to Tor Exit node?

I am monitoring the outbound traffic from mail server through IDS and recently I observed there were some traffic sending to Tor Exit nodes from mail server, for example, IP 46.183.85.124. After doing ...
1
vote
0answers
516 views

SSH attempt blocked now ECDSA keys changed

Last night I had an external IP tried to access my server over SSH. The attempt was blocked as it failed to authorise in the number of times and time limit that I'd specified. Doing a whois on the ip ...
0
votes
0answers
85 views

Under which conditions can dllhost.exe spawn child process? | MITRE ATT&CK T1191

I was looking for conditions/circumstances under which Dllhost.exe can spawn a child process. I examined a huge quantity of event logs from various Windows system and didn't come across any event in ...
0
votes
0answers
98 views

My mail server has seemingly been compromised, but I don't know how

We have a mail server on CPanel, and we added the company email accounts from CPanel. We use outlook as the email client. When we send emails to the procurement department, the hacker gets a copy. ...
0
votes
0answers
965 views

Detection and attribution of a running attack toward US elections

Recently an attack based on booby trapped web servers was blocked by Microsoft through seizure of some of the known server names used in this attack. This attack analysis was focused to defend US ...
0
votes
0answers
70 views

How user can change the tty information (related to CVE-2017-1000367)

Recently Red Hat fixed an important vulnerability in sudo: https://access.redhat.com/security/cve/cve-2017-1000367 From the description: A flaw was found in the way sudo parsed tty information ...