Questions tagged [investigation]
Looking at the inner workings of security systems, their interactions, and scope of coverage
27
questions
1
vote
1
answer
225
views
Host Protected Area (HPA) Imaging
I'm a student in the Digital Forensics department. I have to create an image of the HPA of my disk. I searched whole documents about creating HPA image ways but all of them are old methods. For ...
0
votes
0
answers
2k
views
LSASS Activity is Being Flagged as a Potentially Compromised Host - How should I investigate this?
We've recently been seeing new security events being flagged to the SOC for activity involving LSASS usage from the wmiprvse.exe process across multiple Windows servers. We've investigated the ...
- 11
1
vote
1
answer
259
views
Local Scans initiated from a VLAN Broadcast IP address
Just reviewing some logs and I am seeing local scans to several local IP addresses on port 137 within my network. The source IP however is the broadcast IP of the VLAN (.255).
I have checked the ...
0
votes
0
answers
1k
views
Detection and attribution of a running attack toward US elections
Recently an attack based on booby trapped web servers was blocked by Microsoft through seizure of some of the known server names used in this attack.
This attack analysis was focused to defend US ...
- 3,038
2
votes
1
answer
224
views
What steps should I take now that my online gaming account was compromised?
I recently received emails from my Origin account that my email address and security question had been changed (seems to have been someone in Russia since the new security question was in Russian). ...
- 23
58
votes
2
answers
6k
views
Can you trace malware back to a specific keyboard?
A CNN article on the recent US Election hacks claims that
...the administration has traced the hack to the specific keyboards -- which featured Cyrillic characters -- that were used to construct ...
0
votes
1
answer
448
views
Teamviewer Investigations
I have a situation where Teamviewer was used to remotely log into a computer and delete files. What are some areas where I can find evidence of file deletion and Teamviewer identity of the intruder?
0
votes
1
answer
73
views
Debugging self recreating files
While cleaning up a portable HD I came across a directory that I cannot delete with the error that it is not empty, and that despite trying to delete it with the -rf flags (I am running linux).
I ...
- 178
1
vote
3
answers
9k
views
What is the difference between artifact and evidence
I am reading about the incident response. I cannot able to understand exactly the terms artifact and evidence. When i searched in google so many resources are using these terms generally. How can i ...
- 231
11
votes
1
answer
4k
views
Chrome/ Opera: How to trace and single out this Malware in Browser Extensions? caused by Tab Manager
There have been lot of articles about legitimate chrome/ opera extensions that get sold out to malicious parties that end up pushing the wrong kind of code down the pipe, since by default these ...
- 381
5
votes
1
answer
11k
views
Beyond Nmap: Investigating open TCP ports bound to unknown services
I have an uninvited guest using my private WLAN. At first I thought it was probably just a tech-savvy neighbour in need of Internet access, in which case; it wouldn't really bother me.
However, I've ...
- 1,769
1
vote
1
answer
430
views
Is this an exploit attempt and howcan I analyse it?
Edited: Never mind the MinGW or .bash_history, I can see that is unlikely. Somebody attacking me and those bytes ending up in the frequently used file .bash_history by accident is not that unlikely ...
5
votes
3
answers
4k
views
How bot(s) have guessed my wordpress login page?
I have a wordpress site (fully patched) that used to receive many attempts to log in based on dictionary attacks. I changed my admin user to something uncommon and use a really strong password.
...
- 870
3
votes
2
answers
13k
views
How to extract windows event logs from a hard disk forensic image?
I have created an image of hard disk using FTK imager. I want to extract the windows event logs. The system was running windows 7. What should I do?
- 281
2
votes
1
answer
121
views
iLivid infection/ iLivid behaviour analysis
Although lots of surveys and reports have been done on iLivid by lots of malware analyzers, I decided to inspect iLivid independent of previous research.
I have read lots of reports about iLivid but ...
- 21
1
vote
1
answer
299
views
What question(s) can someone ask an individual to quickly determine their 'hacking ability'?
Scenario: You are on Craigslist searching for cheap electronics and come across an add for cheap E-reader. It's a bit of a deal with about 20-40% off the retail price so you contact the seller and all ...
- 3,632
3
votes
1
answer
2k
views
How can an online hack be traced back to the perpetrators?
What sort of evidence might be used in linking, say, the Sony hack to North Korea? While I am curious about what was used in this particular case, my question is meant to be a more general question ...
- 225
5
votes
1
answer
363
views
What is investigated after a possible hack on servers?
My question follows recent news of the Sony hacking incident. I was wondering what type of investigation is conducted by a security firm or the FBI. For example, if the network servers were hacked, ...
- 159
0
votes
1
answer
94
views
What to do when a Linux account gets owned?
What is the best course of action when you discover that a non-administrator Linux account has gotten owned, and a single foreign process is running, making all sorts of networking connections?
For ...
- 1,924
4
votes
3
answers
2k
views
Ip tracking of stolen laptop
Somebody stole my laptop. I made a connection to it while he had Teamviewer still running. The police says that they can't start tracing the laptop because the IP is abroad. But what doesn't make ...
- 41
3
votes
1
answer
179
views
Forensics in the cloud
I recently did a university module on digital forensics and learned a lot about the process, and techniques, of digital forensics investigations.
We didn't actually cover the cloud although I couldn'...
- 137
5
votes
1
answer
20k
views
How to trace virtual phone number?
Suppose I received a call from internet with some virtual number, I called the same number back after few days but it didn't exist at the time or it was routed to some other user.
Is there a way to ...
- 53
-3
votes
1
answer
147
views
I'm getting my masters in cybersecurity and I have a bs in criminal justice... need guidance [closed]
I'm getting my masters in cyber security. I have a bachelors in criminal justice. I would like to do missing and exploited children investigation. I'm relocating to Georgia. What kind of job should I ...
2
votes
4
answers
1k
views
How does one go about network forensics investigation with no prior knowledge?
I am being asked to perform a forensics investigation on a network.
The reason being that for the past few months strange things are happening on the network. VLANs are being deleted, configuration ...
- 1,550
5
votes
2
answers
2k
views
Google Account Compromised - Possible Investigation?
This morning, I've not been able to login to my Google Account.
Google says, my account has been compromised and I had to walk through account credentials recovery and verify (SMS to verify phone ...
- 2,223
2
votes
2
answers
389
views
SOHO router intrusion
In the hypothetical scenario where someone has managed to gain unlawful access to a SOHO router (any of the consumer wifi models will serve nicely), what steps can you take to verify this, so as to ...
- 3,536
2
votes
2
answers
429
views
What steps can I take to identify what type of compromise of my computer has occured
I got involved in a strange scenario today :-) . Some 'UDPAgent.exe' file/worm/virus was trying to access my collegue's system and the antivirum program was showing that this particular thing is ...
- 1,141