Questions tagged [investigation]

Looking at the inner workings of security systems, their interactions, and scope of coverage

Filter by
Sorted by
Tagged with
0
votes
0answers
37 views

LSASS Activity is Being Flagged as a Potentially Compromised Host - How should I investigate this?

We've recently been seeing new security events being flagged to the SOC for activity involving LSASS usage from the wmiprvse.exe process across multiple Windows servers. We've investigated the ...
1
vote
1answer
47 views

Local Scans initiated from a VLAN Broadcast IP address

Just reviewing some logs and I am seeing local scans to several local IP addresses on port 137 within my network. The source IP however is the broadcast IP of the VLAN (.255). I have checked the ...
0
votes
0answers
965 views

Detection and attribution of a running attack toward US elections

Recently an attack based on booby trapped web servers was blocked by Microsoft through seizure of some of the known server names used in this attack. This attack analysis was focused to defend US ...
2
votes
1answer
164 views

What steps should I take now that my online gaming account was compromised?

I recently received emails from my Origin account that my email address and security question had been changed (seems to have been someone in Russia since the new security question was in Russian). ...
58
votes
2answers
6k views

Can you trace malware back to a specific keyboard?

A CNN article on the recent US Election hacks claims that ...the administration has traced the hack to the specific keyboards -- which featured Cyrillic characters -- that were used to construct ...
0
votes
1answer
248 views

Teamviewer Investigations

I have a situation where Teamviewer was used to remotely log into a computer and delete files. What are some areas where I can find evidence of file deletion and Teamviewer identity of the intruder?
0
votes
1answer
27 views

Debugging self recreating files

While cleaning up a portable HD I came across a directory that I cannot delete with the error that it is not empty, and that despite trying to delete it with the -rf flags (I am running linux). I ...
0
votes
3answers
4k views

What is the difference between artifact and evidence

I am reading about the incident response. I cannot able to understand exactly the terms artifact and evidence. When i searched in google so many resources are using these terms generally. How can i ...
11
votes
1answer
3k views

Chrome/ Opera: How to trace and single out this Malware in Browser Extensions? caused by Tab Manager

There have been lot of articles about legitimate chrome/ opera extensions that get sold out to malicious parties that end up pushing the wrong kind of code down the pipe, since by default these ...
4
votes
1answer
6k views

Beyond Nmap: Investigating open TCP ports bound to unknown services

I have an uninvited guest using my private WLAN. At first I thought it was probably just a tech-savvy neighbour in need of Internet access, in which case; it wouldn't really bother me. However, I've ...
1
vote
1answer
362 views

Is this an exploit attempt and howcan I analyse it?

Edited: Never mind the MinGW or .bash_history, I can see that is unlikely. Somebody attacking me and those bytes ending up in the frequently used file .bash_history by accident is not that unlikely ...
5
votes
3answers
2k views

How bot(s) have guessed my wordpress login page?

I have a wordpress site (fully patched) that used to receive many attempts to log in based on dictionary attacks. I changed my admin user to something uncommon and use a really strong password. ...
2
votes
2answers
6k views

How to extract windows event logs from a hard disk forensic image?

I have created an image of hard disk using FTK imager. I want to extract the windows event logs. The system was running windows 7. What should I do?
2
votes
1answer
71 views

iLivid infection/ iLivid behaviour analysis

Although lots of surveys and reports have been done on iLivid by lots of malware analyzers, I decided to inspect iLivid independent of previous research. I have read lots of reports about iLivid but ...
1
vote
1answer
255 views

What question(s) can someone ask an individual to quickly determine their 'hacking ability'?

Scenario: You are on Craigslist searching for cheap electronics and come across an add for cheap E-reader. It's a bit of a deal with about 20-40% off the retail price so you contact the seller and all ...
3
votes
1answer
2k views

How can an online hack be traced back to the perpetrators?

What sort of evidence might be used in linking, say, the Sony hack to North Korea? While I am curious about what was used in this particular case, my question is meant to be a more general question ...
5
votes
1answer
307 views

What is investigated after a possible hack on servers?

My question follows recent news of the Sony hacking incident. I was wondering what type of investigation is conducted by a security firm or the FBI. For example, if the network servers were hacked, ...
0
votes
1answer
59 views

What to do when a Linux account gets owned?

What is the best course of action when you discover that a non-administrator Linux account has gotten owned, and a single foreign process is running, making all sorts of networking connections? For ...
4
votes
3answers
2k views

Ip tracking of stolen laptop

Somebody stole my laptop. I made a connection to it while he had Teamviewer still running. The police says that they can't start tracing the laptop because the IP is abroad. But what doesn't make ...
3
votes
1answer
134 views

Forensics in the cloud

I recently did a university module on digital forensics and learned a lot about the process, and techniques, of digital forensics investigations. We didn't actually cover the cloud although I couldn'...
5
votes
2answers
14k views

How to trace virtual phone number?

Suppose I received a call from internet with some virtual number, I called the same number back after few days but it didn't exist at the time or it was routed to some other user. Is there a way to ...
-3
votes
1answer
104 views

I'm getting my masters in cybersecurity and I have a bs in criminal justice… need guidance [closed]

I'm getting my masters in cyber security. I have a bachelors in criminal justice. I would like to do missing and exploited children investigation. I'm relocating to Georgia. What kind of job should I ...
1
vote
4answers
1k views

How does one go about network forensics investigation with no prior knowledge?

I am being asked to perform a forensics investigation on a network. The reason being that for the past few months strange things are happening on the network. VLANs are being deleted, configuration ...
5
votes
2answers
1k views

Google Account Compromised - Possible Investigation?

This morning, I've not been able to login to my Google Account. Google says, my account has been compromised and I had to walk through account credentials recovery and verify (SMS to verify phone ...
2
votes
2answers
333 views

SOHO router intrusion

In the hypothetical scenario where someone has managed to gain unlawful access to a SOHO router (any of the consumer wifi models will serve nicely), what steps can you take to verify this, so as to ...
2
votes
2answers
370 views

What steps can I take to identify what type of compromise of my computer has occured

I got involved in a strange scenario today :-) . Some 'UDPAgent.exe' file/worm/virus was trying to access my collegue's system and the antivirum program was showing that this particular thing is ...