Questions tagged [incident-response]

The art of responding to incidents in an organized and thoughtful manner.

Filter by
Sorted by
Tagged with
1
vote
0answers
563 views

SSH attempt blocked now ECDSA keys changed

Last night I had an external IP tried to access my server over SSH. The attempt was blocked as it failed to authorise in the number of times and time limit that I'd specified. Doing a whois on the ip ...
0
votes
0answers
14 views

Internally ran tabletop vs external supplier

I am trying to build a business case for internal vs external red team exercise for 2020, however, struggling to see the advantages of external supplier vs cost unless it's 'full works', e.g. actual ...
0
votes
0answers
64 views

Interpreting SSH information on Windows Event Viewer… sshd: Did not receive identification string from ipaddress on port portnumber

I am currently reading through Windows Event Log (OpenSSH) looking at the artefacts created by an attack, I am trying to understand the meaning of certain notifications. A brute force attack was ...
0
votes
1answer
55 views

Dealing with File Permissions from a Virtual Machine - Forensic Logical Acquisition

I am currently in the middle of operating an analysis on Autopsy of a virtual machine (VMware) that has been hacked. I have mounted the VM and I am acquiring the evidence from VMware to my physical ...
2
votes
1answer
136 views

What forensics should be collected as part of an incident response plan on Windows 10?

I am in the process of creating an IRP that responds to system hacks. I have attacked the Windows 10 myself (victim machine), using Metasploit on Kali Linux software, where I managed to gain access ...
0
votes
1answer
4k views

Is this event a security concern: Windows 10: Event 360, User Device Registration?

My computer just froze, and I ended up having to reboot. It appears Windows Defender was coming up with a notification, but that froze as well. I was trying to see what went wrong in the event ...
3
votes
1answer
134 views

How to detect backdoor/root shells?

Let's assume I'm a user with root access to a machine and I'm a legit user. My machine/server runs Linux. I'm not very familiar with defensive security (I mainly practice offensive). Sometimes, ...
14
votes
2answers
387 views

Establishing routines on what to do if a PC gets stolen

I need to establish routines for how to handle theft of PC equipment, specifically laptops and stationary machines. Also I need to figure out how to make the consequences of stolen equipment minimal. ...
0
votes
2answers
76 views

DoD 52220.22-M (3 Pass wipe) and Virtual Machines

So my place of work, if you can tell by the title is either Gov or Mil, and we recently had a tech refresh where all of our workstations were replaced with VM's. We are running version VMWare Version ...
3
votes
1answer
157 views

Alternative routes for Incident Response approach other than Windows Event Viewer?

I am in preparation of developing an Incident Response Plan for a computer that has been hacked (no malware installed, just a system hack). My plan is to analyse through Windows Event Viewer to try ...
1
vote
0answers
289 views

Volatility: Issue with analyzing Windows 10 and Server 2016 systems

I have been trying to use Volatility 2.6 to analyze memory dumps generated by DumpIt. I am experiencing an issue analyzing the memory dumps (all 4 GB in size) of two Windows 10 64 bit boxes (build ...
1
vote
0answers
93 views

Some questions regarding Red Hat Linux and a case study [closed]

As part of a course I'm doing, it's presented a case study. I'm a bit stuck and not too sure where to find further info. If someone could point me in the direction, I'd appreciate it. In this case ...
1
vote
1answer
69 views

Can a forwarding rule be set on Outlook that will not be visible on office365/exchange admin interface?

In an incident concerning a user's mailbox - will any rule that forwards emails to a potential attack be visible in the office365/exchange admin interface, or is it possible to set an outlook client-...
0
votes
2answers
90 views

Incident response to a medium scale phishing attack whereas the targets are not from our company?

Our company suffered a phishing attack yesterday. While investigating about the attacker and the potential employees of ours who might have been phished, we ended up with the attacker database of ...
0
votes
0answers
91 views

Under which conditions can dllhost.exe spawn child process? | MITRE ATT&CK T1191

I was looking for conditions/circumstances under which Dllhost.exe can spawn a child process. I examined a huge quantity of event logs from various Windows system and didn't come across any event in ...
1
vote
2answers
341 views

Remote code execution and XSS vulnerabilities. What steps should be taken to secure a server once these are discovered and patched?

I've just been notified of a remote code execution vulnerability and an xss vulnerability on a site that I run. I've fixed the responsible code, but I'm wondering what steps should be taken afterwards ...
35
votes
4answers
10k views

Malware that can survive BIOS re-flashing

The well-respected security consultant Dragos Ruiu is reporting that he has been infected with mysterious malware that can survive re-installation of the OS and re-flashing of the OS. In other words, ...
0
votes
2answers
499 views

What is a “proof of concept” file to report security issues?

Last month I reported a security issue to Adobe through an email encrypted with PGP. I recieved the comfirmation email, but no response past that. I checked the "Alert us" page and it said that you ...
0
votes
1answer
92 views

Tools for reverse engineering malicious executables? [closed]

Are there any tools that one can reliably use for decompiling malicious executables in order to understand the inner workings of the same? Or any other reliable tool/way to quickly derive the code?
-2
votes
1answer
118 views

Pure-ftpd connections from unknown IPs

I'm seeing unknown IPs in results like this in the messages log on a CentOS 6 webserver, are these IPs actually accessing the machine? Mar 13 19:11:49 server pure-ftpd: (?@some.ip.here) [INFO] New ...
5
votes
1answer
261 views

a mysterious & pointless long-term hacking attempt?

It seems that I am the target of a mysterious ongoing hacking attempt. I have several domain names, most of which are currently parked & pointed at a single ‘main’ website. For the last couple ...
2
votes
3answers
110 views

Confusing terminologies: Incident, alert, event, ticket [duplicate]

I am doing research on Security orchestration and automation response (SOAR) and three above terminologies make me very confused. We are currently following the workflow like: some security events ...
1
vote
3answers
177 views

What use to automate incident response? [closed]

I am now read about TheHive Project - open source incident response platform. Today i asked developers about automatization of incidents, and find, that TheHive can't do this. Main feature for me is ...
0
votes
0answers
101 views

My mail server has seemingly been compromised, but I don't know how

We have a mail server on CPanel, and we added the company email accounts from CPanel. We use outlook as the email client. When we send emails to the procurement department, the hacker gets a copy. ...
5
votes
5answers
703 views

Incident response and recovery from a security breach with unknown attack vector

Security breaches, hacks, “cyber” attacks or server compromises happen quite frequently, unfortunately, such as Quora in December 2018, Facebook in September 2018, Equifax in September 2017, Exactis ...
1
vote
1answer
125 views

Persistent Bootable USB with Write Protection?

I am developing a series of extraction scripts (currently python 2.7) for a university project - these tools will be provided on a bootable USB for use by first responders when encountering a suspect ...
47
votes
3answers
8k views

Should we keep logs forever to investigate past data breaches?

Listening to the Secure code lessons from Have I Been Pwned made me really think about logging. It appears that in the real world a lot of data breaches are discovered long after they happened which ...
64
votes
5answers
17k views

Can Beehive detect a Snowden-like actor?

In a seminar, one of the Authors of Beehive: Large-Scale Log Analysis for Detecting Suspicious Activity in Enterprise Networks said that this system can prevent actions like Snowden did. From their ...
27
votes
4answers
9k views

I detected someone probing my site for weaknesses, what can I do about it? [duplicate]

My site has been getting probed by a bunch of IPs from Morroco (trying to submit forms, trying out potential URLs, trying to execute scripts etc..), I have a strong suspicion it's the same person ...
1
vote
3answers
4k views

What is the difference between artifact and evidence

I am reading about the incident response. I cannot able to understand exactly the terms artifact and evidence. When i searched in google so many resources are using these terms generally. How can i ...
0
votes
1answer
55 views

How to recover disk image from a smartphone in “bootloop” state?

I've been playing around on data recovery from devices and so far it worked well. Now I got this new situation that I don't know how to proceed in order to put my hands on the data. My old smartphone ...
1
vote
2answers
949 views

Transmitting malicious code over audio speakers

In a post that reads like science-fiction, a security researcher claims that malicious code was being passed between computers. A few quotes: ... "badBIOS," as Ruiu dubbed the malware, has the ...
0
votes
0answers
965 views

Detection and attribution of a running attack toward US elections

Recently an attack based on booby trapped web servers was blocked by Microsoft through seizure of some of the known server names used in this attack. This attack analysis was focused to defend US ...
3
votes
1answer
63 views

Methodology for finding existing adversary presence on network

A technology company starts small in the early 90's and, for various reasons, blows up into a multi-million dollar company in a very short time around 2013. The problem is that this company is ...
0
votes
1answer
110 views

CSIRT Softwares [closed]

I'm wondering what kind of software Computer Security Emergency Response teams use to manage their work? For example to catalog incidents, responses and manage risks.
2
votes
1answer
321 views

Use Splunk to run Nmap scan from remote host to potential attacker

When receiving internal attacks, I'd like to utilize Splunk alerts to trigger an Nmap scan against that attacking host from a remote machine; one other than the Splunk server. Is there any API or ...
2
votes
3answers
453 views

evidence collection in incident response

In incident response, should evidence collection be done before incident containment or after? If both, when evidence collection should be done before and when should it be done after (examples are ...
57
votes
8answers
19k views

Brutalized VPS recovery data now available. Considerations? [closed]

Backstory My sites and VPS were stolen from me. The hosting company and I were locked out and unable to access it. They weren't able to create a temp password for access because the attacker blocked ...
1
vote
1answer
253 views

CEH Incident Response phases: Investigation vs Analysis

I am preparing for CEH from Oriyano book. He refers to NIST's incident response phases. These phases are: Response Triage Investigation Containment Analysis and tracking Recovery Repair Debriefing ...
3
votes
1answer
98 views

Managing critical passwords and data across a small business with a focus on business continuity

I work with a small startup in the beginning of it's life cycle. I recently raised some security concerns involving business continuity and emergency preparedness. I have been trying to make a ...
17
votes
8answers
4k views

Facebook account keeps getting hacked, can't seem to figure out why or how?

One of my friends, she has a lot of friends on Facebook, and uses it for marketing. Her account keeps getting broken into. Her password gets reset and/or gets locked for changing resetting password ...
1
vote
1answer
234 views

Can we know what hacker has come up to so far in his attempt?

I have discovered 'accidentally' while searching in my command history, that some one has issued these : passwd w cat /proc/cpuinfo free -m uptime w perl v.py python v.py chmod +x * ./a 94.10 and ...
1
vote
1answer
335 views

SSD Wipe to remove known & unknown malware [duplicate]

Does anyone know of a method to wipe a HDD that gives a high degree of confidence that any malware present will not persist when the OS is reinstalled? Using tools on Linux and/or Windows? We have ...
1
vote
0answers
244 views

Invalid certificate error appears on my web server for 10 minutes and then disappears

I have a raspberry pi that hosts a web server and has a DDNS registered through no-ip. I just had an issue connecting to my webserver because a certificate appeared to be installed on this server that ...
2
votes
2answers
139 views

How to best educate users on telltale signs of malware infections?

My company is in the process of training and testing all employees on our security policies and practices. As a member of the team doing this training and testing, I had a thought that it may be ...
36
votes
4answers
3k views

Why did my provider reset my password after someone else attempted to gain access to my account?

Recently a provider (of SIP trunking services) I subscribe to sent me a strange email. It claimed that someone in another country attempted to reset the password to my account and was unsuccessful in ...
2
votes
2answers
596 views

What's the danger of malicious JS and .DOC files in the AppData\Local\Temp folder?

I keep seeing malicious .DOC and .JS files appear in the \AppData\Local\Temp & the \Temporary Internet Files of users. A few questions: Under what circumstances do DOCs and JS files appear in ...
16
votes
8answers
3k views

How to make people report incidents?

I would like to know how you make employees report incidents. Incident reports are a key element of an ISMS. No reports = No discovery of the incident = High chance things go out of control. We have ...
0
votes
3answers
93 views

Is it recommended to patch announced vulnerability for unused services or features?

Sometimes vendors announce software upgrade to patch some discovered vulnerability in some feature or service which is not enabled in your system. Is it recommended to upgrade your software although ...
8
votes
3answers
2k views

What does a court need to successfully prosecute a hacker? Please cite previous cases if possible [closed]

Once a business decides it is worthwhile to persue legal action against the attacker, what information and processes should be followed so that: Integrity of the investigation is maintained The ...