Questions tagged [intrusion]

Intrusion the act of wrongfully entering upon, seizing, or taking possession of property owned and/or operated by others.

Filter by
Sorted by
Tagged with
2 votes
0 answers
406 views

How to recover a file with volatility from a linux profile [closed]

I'm trying to recover files from a .mem file with volatility. The mem file is from a Linux machine. I have already loaded the profile and it works fine. I have discovered that the drupalgeddon2 ...
P00's user avatar
  • 43
0 votes
0 answers
66 views

Unexpected drop in UFW noise, should I be worried?

I run a bare-metal on-premises GitLab server (Ubuntu 22.04) for a very small company. While the server isn't currently in production use, it is active and accessible over the public internet. I have ...
rdi_pck's user avatar
0 votes
0 answers
40 views

WIPS and IDS vs NDR

My organisation has a Network Detection and Recovery (NDR) but does not have an WIPS/ WIDS. Because NDR is usually hooked to the core switch, is this enough to detect and mitigate against threats ...
Ethic Or Logics's user avatar
1 vote
1 answer
466 views

How to track which php file executed a malware binary

I have a server that seems to be compromised checking the processes running I see an executable that seems to be a mining malware and the hacker uses it to mine litecoin at the address ...
MOHAMMAD RASIM's user avatar
0 votes
0 answers
394 views

How to determine Snort rules source & destination IP and port

How do you figure out Snort's source & destination IP and port if the question is so vague? For example: Write a snort rule that detects a UK NI number sent from a client's web browser to a web ...
Elaine's user avatar
  • 1
0 votes
1 answer
1k views

Does Microsoft scan the contents of documents uploaded to onedrives personal vault?

Specifically do they, but not "Can they" only because I'm fully aware that they are, and always have been, capable of intruding on any/all personal/sensitive data that isn't encrypted on a ...
Casper's user avatar
  • 1
0 votes
1 answer
88 views

Odd Kerberos Hosts After HD Wipe, and fresh OS re-install

After reformatting my hard disk and rebuilding/re-installing the latest macOS operating system, I found the following IP addresses after running Kerberos.internal.com: kerberos.internal.com has ...
petergibbons's user avatar
0 votes
4 answers
207 views

Mouse moving while unattended, how can I check for intrusions

A few hours ago, I spotted my unattended mouse moving and seeming to click on tabs. I promptly rebooted my system and removed Teamviewer (it's the only remote connection app that I have installed), ...
Olumide's user avatar
  • 101
1 vote
1 answer
438 views

Can an Intrusion Prevention System (e.g. Snort) prevent CSRF and XSS attacks?

I am currently learning about IPS and was wondering about a query that applies to how IPS works. I have knowledge of CSRF and XSS attacks, however I am unsure if Intrusion Prevention Systems can ...
dwayne_d11's user avatar
0 votes
0 answers
116 views

Is every packet of a hostile network flow hostile?

We are building a packet based anomaly detection system and I'm trying to find labeled packets. Such dataset doesn't exist based on my search, but I can find labeled flows. Can we say that every ...
user128576's user avatar
3 votes
0 answers
2k views

Unknown device on my home's local network. What to do about it?

My home router's configuration interface shows a device I don't know, connected via WiFi to my local network. According to the router's history, that device connected to it several days ago. It is ...
Hey's user avatar
  • 1,935
1 vote
0 answers
100 views

Strange Proxy Application Behavior on iOS 13.5.1

Background: My buddy is a freelance journalist working on a story on one of the bigger software companies (a household name, starts with an A). Anyway, he asked me to take a look at his iPad because ...
David's user avatar
  • 11
0 votes
1 answer
295 views

Finding mechanism of unauthorized data access on OneDrive/Windows 10

An ex-girlfriend has demonstrated an ongoing ability to access files stored only on my Windows 10 x64 PCs and Microsoft OneDrive. How can I find or trace the mechanism by which she is doing this? ...
Lysander's user avatar
  • 101
0 votes
0 answers
108 views

Possible to verify the integrity of AIDE itself?

I recently installed the package AIDE (Advanced Intrusion Detection Environment) on my Linux server. This is a web server installed about a year ago. Since no integrity checks have been done before on ...
pmbonneau's user avatar
  • 191
0 votes
3 answers
504 views

How long does it take to have spyware installed on a laptop?

During my commute from an airport located in a country whose government is known for intrusions into the privacy of its citizens and non-citizens, I had my laptop taken from me during a routine ...
Razgriz's user avatar
0 votes
1 answer
932 views

Is fail2ban an intrusion prevention system?

I know what fail2ban does; it monitors the firewall logs and finds ip addresses that have too many failed logins to ssh; and then tells the firewall to drop packets from those addresses. So is ...
leeand00's user avatar
  • 1,385
0 votes
1 answer
202 views

What do people mean when they talk about "hackers gaining access to our network" (at home)?

Have I fundamentally missed something between the time when I sat with my 486 IBM PC in the house, fully offline, and today? Do normal people actually set up complex local networks in their homes ...
Kenneth's user avatar
  • 11
1 vote
0 answers
152 views

How to check if hard disk was removed while in sleep mode?

Let's say that some malicious person extracts my hard disk (HDD or SSD) from my laptop, while it is in sleep mode. Is there a way to check for that event? I am mostly interested for Ubuntu OS, but if ...
pgmank's user avatar
  • 425
1 vote
1 answer
321 views

Norton Security blocked "Fake Tech Support Website" within router?

Norton Security (software installed on the computer) supposedly blocked a fake website coming from my internet router. (See the full alert details window screenshot). My internet router is a BT Home ...
Chris Rogers's user avatar
0 votes
0 answers
570 views

VDSL modem getting probed?

My ZyXEL VMG8924-B30A VDSL modem recently had these alerts in its log. The WAN IP address of the modem is 10.225.205.128. There was nothing like this before 1 May. What is this? 2019 -05 -01 T16:05:...
rickhg12hs's user avatar
1 vote
1 answer
696 views

Public Availability of a good Dataset in PCAP (TCPDUMP) format for IDS/IPS testing [closed]

I am trying to pass good reputable malicious traffic from an IPS. There are several sources on internet to explore datasets like the oldest I think DARPA set (not available in pcap format and not that ...
aneela's user avatar
  • 191
172 votes
4 answers
44k views

GitLab account hacked and repo wiped

I was working on a project, a private repo, and suddenly all the commits disappeared and were replaced with a single text file saying To recover your lost code and avoid leaking it: Send us 0.1 ...
Stefan Gabos's user avatar
  • 1,113
19 votes
1 answer
5k views

Github account hacked and repo wiped - Github Response

One of my repo's was wiped today and just a message left in its place with a bitcoin ransom. I've no idea how they accessed my account, can't really see anything on github security page. The domain of ...
Raymie's user avatar
  • 191
2 votes
0 answers
607 views

Can Zeek (formerly Bro) be installed as in-line IPS?

I'm starting a comparison paper about inline Network IPS. I was looking for an opensource anomaly-based detection engine with IPS capabilities. The easiest choice seemed Zeek(formerly Bro) but from ...
tanacca84's user avatar
0 votes
1 answer
6k views

Snort rule for syn flood attacks - Limiting number of alerts

So I have a snort rule that detects syn flood attacks that looks like this: alert tcp any any -> $HOME_NET 80 (msg:”SYN Flood - SSH"; flags:S; flow: stateless; detection_filter: track by_dst, ...
Liam's user avatar
  • 1
2 votes
1 answer
382 views

What features would you use to detect a backdoor or a bot installation?

I was reading a document about logging and analysis. The document talks about statistical analysis and machine learning techniques to detect some attack scenarios. For instance, If you want to detect ...
U. User's user avatar
  • 180
1 vote
0 answers
84 views

I think my ssh server is under attack and it's really trecherous [duplicate]

I'm new here so please bear with me. And thanks for the opportunity. This is an awesome resource. For the past few days, my ssh server (it's a small convenience I run just so that I can access my ...
Mark Adams's user avatar
0 votes
3 answers
8k views

intrusion prevention system detected "et policy pe exe" should i worry

I have a UniFi Security Gateway (USG Pro 4P) and just enabled IPS (intrusion prevention system). I am seeing many "ET POLICY PE EXE or DLL Windows file download HTTP" alerts. I have not been able to ...
M.Ford's user avatar
  • 101
1 vote
0 answers
124 views

Looking for incident response data

Good evening cybersecurity community; I am looking for a nice data set that comprises some cybersecurity incidents and describes how these incidents were solved. Doing such documentation is e.g. ...
attr1bute's user avatar
2 votes
1 answer
224 views

Can IP address considered as a useful feature for intrusion detection?

I am trying to build a machine learning model which classifies attacks. My data has a bunch of IP addresses, and I don't know if I should use the IP address as a feature to detect attacks. I found ...
U. User's user avatar
  • 180
2 votes
1 answer
525 views

Compromise Google GSuite by buying expired domain

I saw a question a few days ago that talked about if a domain is bought by someone else then would the emails to that domain be compromised. And it got me thinking about google gsuite and specifically ...
majidarif's user avatar
  • 121
-1 votes
1 answer
995 views

How to safely expose a computer to the Internet with a public IP

Our LAN is configured behind a load balancing router, in turn connected to a modem assigning public IPs to connected devices. I am required to randomly test the connection effective throughput, ...
Riccardo's user avatar
  • 145
0 votes
1 answer
359 views

How likely is it to see a commercial IDS/IPS that uses machine learning in the near future that performs better than a normal IDS/IPS? [closed]

I have to choose a field to study on and I want to know does it worth studying in this field and will the future IDS/IPS systems be using machine-learning/deep-learning or at least how likely is it? ...
AlenT's user avatar
  • 200
4 votes
1 answer
297 views

Windows: Who is this randomname person that authored *my* LibreOffice document?

A friend of mine for which I manage the computer has presented me a problem. How is it possible that Windows shows a random name in field "Authors" for a given document ? Here is a bit of context: ...
Gabriel Devillers's user avatar
0 votes
1 answer
263 views

Does this evidence seem consistent with an intrusion via the VNC server?

I am new to this forum, so apologies in advance if this question does not seem to fall within its scope, or if it seems too long: On two occasions over the past ~3 weeks, a hacker gained remote ...
kc32768's user avatar
1 vote
0 answers
296 views

Snort not working with IDSWakeup

I have setup Snort with the registered user rules installed. I tested first by making the following rule in local.rules: alert icmp any any -> $HOME_NET any (msg:"ICMP test"; sid:10000001; rev:...
Daniel Lawton's user avatar
3 votes
1 answer
219 views

Is there some type of x-ray that can see through HSM or shielded integrated circuit?

I know that security-oriented products can easily protect their contents from even the most sensitive commercial x-rays, which can see objects at about 0.5µm. But let's put cost limits aside (or ...
fernacolo's user avatar
  • 244
2 votes
0 answers
330 views

What is the best way to test my anomaly detection system?

I have an IDS (Intrusion Detection System) built in C and I need to test it with real traffic. It is an anomaly detection system, so I need to train it with normal traffic first. The IDS that I built ...
user8955046's user avatar
-2 votes
1 answer
343 views

Anomaly based IDS Vs Protocol state based IDS

Is there any difference between them? On google, I can find many description about anomaly based IDS. But I can not find any description about protocol state based IDS.
Ju Ju's user avatar
  • 39
1 vote
1 answer
471 views

Potential intrusion on home network?

I was browsing through my home network linksys router logs today and noticed an incoming connection from 41.212.36.114 to port 44543. I checked out this IP address at it's coming from Kenya. I'm in ...
StatsStudent's user avatar
-2 votes
1 answer
125 views

Difficulty of accessing a physically connected Windows computer with disabled network adapter

Please consider the following setup: A computer running a non-deprecated and up-to-date version of Windows (e.g. 7/8/10) is physically connected to a LAN or WAN network by means of a plugged-in ...
126047281's user avatar
0 votes
1 answer
14k views

Is this event a security concern: Windows 10: Event 360, User Device Registration?

My computer just froze, and I ended up having to reboot. It appears Windows Defender was coming up with a notification, but that froze as well. I was trying to see what went wrong in the event ...
Jonathan's user avatar
  • 3,157
3 votes
1 answer
334 views

How would an external attacker utilise universal plug and play to bypass a firewall?

I'm wondering what strategies and techniques are used to bypass firewalls which have universal plug and play. I'm aware of security issues regarding UPNP in the past but I've also heard that there ...
Error Magnet's user avatar
0 votes
3 answers
198 views

What kind of damage controls should an online banking web application implement?

Considering an online banking or paypal-type web application with username/password login and two factor authentication (2FA) for transactions What are best practice security measures for damage ...
problemofficer - n.f. Monica's user avatar
1 vote
1 answer
286 views

Can using simultaneous intrusion detection systems (IDS) create conflicts?

Can simultaneously using 2 or more intrusion detection systems (IDS) on the same computer or network create conflicts ? Talking about tools (as examples) such as but not limited to: tripwire, bro, ...
MFJC's user avatar
  • 123
-1 votes
2 answers
2k views

Popup window stating computer is hacked [duplicate]

I recently got a message on my laptop screen that someone is stealing: my credit card info my pictures facebook info However, nothing seems wrong with my facebook and I have all my pictures and apps....
Wolf Spirit's user avatar
1 vote
3 answers
2k views

Are these log entries normal?

I have noticed high CPU usage, and noticed that user dinko had high CPU usage with the sshd process when I typed top. User dinko was just some random user that I created and had a Ruby application ...
Aleksandar Pavić's user avatar
14 votes
2 answers
16k views

HIDS - Choosing between regular OSSEC or Wazuh fork

I intend to set up OSSEC and noticed there seem to be two main flavours: plain OSSEC and Wazuh fork. From what I've been able to gather (from Wazuh's website and documentation), the main advantages ...
simoesf's user avatar
  • 143
1 vote
1 answer
253 views

non-rfc1918 address appeared on router dashboard

Quick context: Home network, performing some DPI on my perimeter router (Ubiquiti EdgeRouter Lite) that governs 2 internal subnets separating my traffic from a bunch of roommate devices. No IDS on the ...
user avatar
2 votes
2 answers
212 views

WireShark tried to load a suspicious system.dll

When starting Wireshark (v1.12.2, using runas /user:administrator) on an old Windows XP SP3 system, Privacyware Privatefirewall alerted me that Wireshark was trying to load c:\docume~1\admini~1\locals~...
Jonathan J. Bloggs's user avatar