Questions tagged [indicator-of-compromise]
The indicator-of-compromise tag has no usage guidance.
15
questions
0
votes
0
answers
104
views
Kerberos protocol attacks?
I have a question in my mind regarding the inner workings of Kerberos protocol. If the generation of the session key is somehow insecure, does this compromise the security of the Kerberos protocol?
I ...
- 43
0
votes
2
answers
81
views
What are some symptoms of malware exfiltrating data in packet captures?
I am concerned that my Linux laptop has been compromised with malware that is remotely and regularly monitoring my activity. I ran Wireshark for a day to see if I could find any symptoms of data being ...
- 1
0
votes
1
answer
87
views
What are the indications on my smartphone that I have security problem/data leak/trojan
I am using a paid (non-free) antivirus on my Android 13. I am curious however, what would be the signs/"symptoms" in case I have data leakage/security issues/trojan on my smartphone? How can ...
- 255
-1
votes
1
answer
108
views
Unknown localhost connections: Is this indication of continued compromise of device?
I have a stalker, and six months ago, he got my someone to evil maid my devices with a USB stick that person had borrowed (which then took me three months to discover). This attack appeared to have ...
- 1
0
votes
2
answers
137
views
Are there Indicators of Attack or Indicators of Compromise (IoA, IoC) or suspicious events specific to stalkerware?
By stalkerware I mean the type of spyware that is typically marketed as a tool to catch a cheating spouse (or similar).
I am asking because the motive for this type of attack is somewhat different ...
user266997
0
votes
1
answer
220
views
Pornographic image in Wikipedia app
I opened up the Wikipedia app on my iPhone today and saw that the featured article on the main page was on “Henry IV, Holy Roman Emperor”. However, the image displayed for the article was a closeup ...
- 115
1
vote
1
answer
302
views
Why am I seeing this in /var/log?
I've noticed a lot of weird logs in /var/log on my server.
For example:
cd /var/log/DIST00000001ARGC00000005ARGV00000002ccARGV00000002-cARGV00000006nmap.cARGV00000002-oARGV00000006nmap.oDOTI00000000
...
- 111
1
vote
0
answers
352
views
How did SolarWinds get hacked? And was the Orion update put out without human approval? [closed]
Obviously there is massive information about the SolarWinds Orion hack itself of the malicious DLL injected into the update: https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-...
- 121
2
votes
2
answers
166
views
What to make of inconsistent TFA/2FA verification emails from AOL
My parents use AOL (there's no point trying to migrate them at this stage) with two factor authentication. My father let me know that he recently received an identity log in verification email that ...
- 131
0
votes
1
answer
800
views
How can I add a MISP STIX feed to LogRhythm?
I have a MISP server set up. I then use a REST API endpoint to get a STIX feed from that server. This portion appears to be working fine. I then try to add that STIX feed to LogRhythms Threat ...
- 885
0
votes
0
answers
171
views
Logged in with a hacker's email address
I have an active account at ebay-kleinanzeigen.de (like Craigslist in the US).
Today I got a valid email from them that my email address was changed.
On my mac, I opened up my ebay-kleinanzeigen ...
- 101
2
votes
0
answers
277
views
Refurbished Samsung Galaxy Watch - check for compromise
I recently purchased a refurbished Samsung Galaxy Watch off Amazon through a third-party seller. Now, a few hours later, it occurs to me that it is possible that the previous owner could have rooted ...
- 1,268
0
votes
0
answers
161
views
Threat Hunting Observations : Basic Scoring Jupyter Notebook for Running processes on Windows Operating Systems
I am trying to create a scoring Jupyter Notebook created for Windows Processes and I was wondering about what information would I exactly need to generate a basic Score for each process running on a ...
- 33
0
votes
2
answers
1k
views
On urlscan.io Indicators of Compromise, what do the hashes represent?
When I look up a domain of interest on urlscan.io, I see a lot of interesting information.
When I click on "Indicators of compromise" (IOC), I see a list of hashes that are actually links to pages ...
- 6,844
3
votes
4
answers
1k
views
Indicator of Compromise effective periods [closed]
How long should IOCs be monitored even thou they might be "outdated"? Are there best practices or other reasonings?
I would think monitoring IOCs indefinitely is not ideal. Perhaps 90 days would ...
- 1,273