Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
Make your voice heard. Take the 2019 Developer Survey now

Questions tagged [log-analysis]

The tag has no usage guidance.

0
votes
0answers
20 views

mod security rule to send email on every trigger

I made a script that reads the log file of the modsec 3 module in apache. It sends an email every 5 minutes with new triggers. I discovered that it is also possible to execute a script (e.g. send ...
-1
votes
1answer
73 views

Is Private Internet Access (PIA) VPN safe to use? [closed]

As said in the PIA website they pretend to have the following VPN features: PPTP, OpenVPN and L2TP/IPSec SOCKS5 Proxy Included No traffic logs So my question are: Is Private Internet Access VPN ...
0
votes
1answer
56 views

Heuristics to Identify CSRF from Web Access Log File

I am new here in security. I want to identify suspicious users on web application by analyzing web access log file. For this, I am considering CSRF attack. For this purpose, I am generating some ...
2
votes
2answers
47 views

What are the common features to identify CSRF attack from Apache log file?

I have tried CSRF attack on web vulnerability application known as DVWA at my localhost and on kali linux OS. I have changed password on this application by using CSRF. It has collected following log ...
1
vote
2answers
129 views

Are log files executable files?

As a beginner in security research project, I came across log injection and my question is itself about log injection files. Are log injection files executable, if no, how do they execute/run ...
0
votes
0answers
34 views

Track logs in Ubuntu Linux

I am using Ubuntu linux. I want to track my data which is going to the internet or coming from internet.  As per my knowledge, few softwares are uploading logs on their sites which contains basic ...
2
votes
2answers
97 views

Does an admin need legitimaly to access his own logs generated by auditd?

In my understanding, admins need to access logs of the servers, workstations, services and applications they manage, either for administration or debugging purposes, never to logs generated by auditd ...
3
votes
1answer
112 views

MacBookPro's OSX install.log has entries that predate the initial unboxing

Basically what the title says. I recently had a look at my /var/log/install.log and the earliest entries are from about 2 full months prior to me unboxing the computer. The packaging had cellophane, ...
0
votes
0answers
121 views

Multiple sshd sessions for single SSH login

I was grepping through /var/log/auth.log and noticed that for some reason, not every time, but sometimes when I would log in via SSH I would see entries like the following - where there were multiple ...
0
votes
0answers
66 views

event 4625 - log-in failures from an encrypted username

I am getting tons of these errors everyday for the past weeks, all having the same account name. I tried decoding the name using base64 but it seems that it uses another encryption. I really do not ...
0
votes
1answer
67 views

I need help finding a list or a reference of DLL's for discovering hijacked programs

I am removing malware from my grandpa's Windows computer using the system internals suite. I suspect he has a Trojan which has been making remote connections and downloading a TON of viruses every day....
2
votes
1answer
54 views

Windows: What are the security implication of adding Network Service account to “Event Log Readers” group?

I want to read security audit logs from a network service. By default, Network Service does not have permission to read but it can if the account is added to "Event Log Readers". One of the examples ...
2
votes
4answers
265 views

SOC and generic log parsing

I am making a conceptual work-flow of a SOC so if we suppose that a SIEM solution is integrated inside an organization's in-house SOC. Also, if the team of the SOC is the one managing the SIEM ...
0
votes
0answers
50 views

What is going on with these requests? HEAD with encoded backslash, and my site embedded in the url

I found these entries in my access log, and I found them rather weird. As I don't know what HEAD's purpose is here or what their intent was with this. I have the first couple as an example, but it's ...
-2
votes
2answers
111 views

How to get a thorough view of wireless router's logs?

I am trying to attack my wireless router using Kali Linux for learning purposes. When I check the wireless router's logs after a successful attack, it doesn't show me the logs related to attacks which ...
0
votes
0answers
69 views

Are these HTTP_REFERER from a bot-net? Are they harmful? How should I handle them?

We are getting a huge amount of requests that I can not explain. These request all go to admin.OURWEBSITE.com/api/analyze/, but we do not have an admin subdomain and we do not have an api/analyze ...
0
votes
0answers
83 views

How can a Logon Type 2 be initiated with seclogon?

Looking into what turned out to be an FP, I found an event that showed a PC having failed a login (Event ID: 4624) with a local account, Logon Type: 2 and Logon Process: seclogon. Consent.exe was not ...
0
votes
1answer
53 views

Difference between legitimate file transfer vs data exfiltration of confidential files using FTP

I have FTP logs and some other logs assuming that corporate environment is actively monitored. How would I know that user is using ftp to transfer regular file and not using the same to transfer ...
1
vote
0answers
139 views

Dovecot in auth.log suspicious entry analysis

I am wondering is this entry in auth.log something that I should be concerned about Feb 22 12:18:25 host1 auth: pam_unix(dovecot:auth): check pass; user unknown Feb 22 12:18:25 host1 auth: pam_unix(...
0
votes
1answer
50 views

Historical IP reputation data

I have a firewall log with events from 2 years ago. I want to examine that log as if I was investigating at the time of collection (2 years ago). However, I would like to use IP address reputation ...
2
votes
2answers
71 views

What is the best way to analyze results of a technical security assessment? [closed]

I want to conduct a technical security assessment on my company's client computers with focus on Windows 10. So far, my idea is to execute several Powershell scripts on the clients and gather the ...
-1
votes
1answer
76 views

Access log of someone using different IPs to send the same type of traffic

I have a magento shop system and I read this in my logs: 206.75.231.xxx - - [14/Dec/2017:19:59:11 +0100] "POST /downloader/ HTTP/1.1" 403 220 "-" "Mozilla/5.0 (Windows NT 5.1; rv:32.0) Gecko/20100101 ...
0
votes
0answers
708 views

Safari logs on MacOS

How can I prove that a user accessed a specific Gmail account on Safari, assuming that he has deleted the browsing history?
2
votes
1answer
746 views

Suspcious timing of [LAN access from remote] in router log

I read that [LAN access from remote] to UPnP ports can be an attacker looking for vulnerabilities, and is usually nothing to worry about. However I'm concerned seeing this activity in a log so close ...
1
vote
0answers
123 views

Identifying privilege escalation in OSSEC logs [closed]

I am working on an intrusion detection system which can prioritize and attribute the logs generated by OSSEC. So, how can I understand a privilege escalation case (or just the privileges a user has at ...
0
votes
0answers
3k views

Is this event a security concern: Windows 10: Event 360, User Device Registration?

My computer just froze, and I ended up having to reboot. It appears Windows Defender was coming up with a notification, but that froze as well. I was trying to see what went wrong in the event ...
0
votes
0answers
3k views

How to find who was remotely using my mac… Here are log files

So I walked away from my mac for about 30 minutes and when I returned someone had opened up a new Facebook tab and was uploading a picture. As soon as I was behind the computer, they stopped. It ...
3
votes
2answers
83 views

Flash Drive: Is it possible to figure out what/when files were added?

Recently left my flash drive on the university computers and someone found it. He said he looked through the flash drive to find my resume and contact me. I want to leave this situation in good faith, ...
1
vote
3answers
780 views

Are these log entries normal?

I have noticed high CPU usage, and noticed that user dinko had high CPU usage with the sshd process when I typed top. User dinko was just some random user that I created and had a Ruby application ...
1
vote
0answers
55 views

Would extracting logs from a European server to a US SIEM system cause privacy legal concerns?

Looking for an answer related to the European "General Data Protection Regulation." laws.
3
votes
2answers
4k views

How to find who granted local admin privileges to a user?

A friend of mine works in an organisation and one fine day realised that he has local admin access on his machine. He swear to me that he didn't have the privilege initially and needed to raise ...
2
votes
1answer
228 views

What does this suspicious activity in my log suggest?

I found following log lines on my asterisk program (VoIP) running on debian Jessie server 3.4.112 for arm [2016-12-25 01:58:52] NOTICE[12054] res_pjsip/pjsip_distributor.c: Request 'INVITE' from '"...
5
votes
0answers
240 views

http request: your killing me smalls [duplicate]

I was looking through my Apache Status in WHM and noticed this odd line in the log: POST /your/killing/me/smalls.jpg HTTP/1.1 It is mostly from 54.86.11.108 but I have seen at least one other IP. I'...
2
votes
1answer
795 views

What vulnerability might this invalid HTTP_HOST value be trying to exploit?

I just received an error email from my home web-server (It's a low traffic site, and since it's running a Django application I've written myself getting an email on errors helps me find bugs). ...
2
votes
0answers
2k views

Anyone can identify tool used to perform this attack?

recently I've identified that some hack attempt was performed at one of my servers. I have dumped nginx logs to github, please take a look and try to identify which tool was used to perform this ...
1
vote
1answer
131 views

Can the data transfered from a PC to Dropbox or a USB drive be logged and detected?

I have some problems with my manager and am in process of using a lawyer to litigate with regards to workplace harassment. The litigation is planned to be "soft" and my lawyer only plans to send the ...
0
votes
1answer
167 views

How does a person request gmail.com from my server?

I run a number of websites / web services on NGINX with Ubuntu. Today I noticed the following line in my rogue.access.log (I have a separate vhost/log file to catch all requests for websites other ...
4
votes
2answers
2k views

How can I read snort logs in NIDS mode?

I am reading some snort logs from a firewall, I could read some with "snort -r file" But when I had tried the newest logs I get this error: snort -r snort.log Running in packet dump mode -...
0
votes
1answer
577 views

Are SIEM and NIDS/HIDS complementary?

I just would like to have your feedback if you were involved with Security Information and Event Management. From your experience, do we have to add a SIEM to an existing NIDS (snort) and HIDS (ossec)...
7
votes
1answer
3k views

Which ssh exploit works by changing the user name in the middle of the process?

Every few hours, I get a few of those in my server logs: sshd[...]: Disconnecting: Change of username or service not allowed: (httpd,ssh-connection) -> (http,ssh-connection) [preauth] sshd[...]: ...
3
votes
1answer
495 views

Linux log files to back up and review for security

Good morning/afternoon/evening everyone, I am looking into what files I should consistently back up externally from my machine to be able to monitor for any unusual activity. I would look at the files ...
1
vote
2answers
343 views

“CHANGELOG.txt” in Apache logs

Recently I've been seeing a major uptick in the following type of requests to my Apache logs: "GET /CHANGELOG.txt HTTP/1.1" 404 211 About a month ago, I received none. Now I receive a dozen or so ...
24
votes
1answer
6k views

Why am I receiving HTTP GETs for a domain I don't own?

I am running a Centos7 web server. I noticed a few strange HTTP GET requests like these: 94.185.83.100 - - [29/Feb/2016:23:29:00 +0530] "GET http://testp1.piwo.pila.pl/testproxy.php HTTP/1.1" 404 390 ...
13
votes
2answers
1k views

Weird Log Record from researchscan1.eecs.berkeley.edu (169.229.3.91) - is this a hack attempt?

I was looking through my ufw log record when I found this line: 169.229.3.91 - - [19/Feb/2016:13:21:52 +0100] "\xCEA\x81\xCF\x02\x03\xFCAm\xB8\xBF]1\xBE~0^\xCD\xA9\x05(\x8D`\xD9\x9D\x9D\x9C\x15m" ...
0
votes
0answers
295 views

script for analysis of tcpdump log file

I'm trying to get the following metrics from my tcpdump log file: (1) one-way delay, (2) request/response delay, (3) packet loss, (4) overall transaction duration and (5) delay variation (jitter). ...
2
votes
3answers
329 views

Are people trying to hack my website?

On my website I added a little function, that logs IP, client/browser information, path, and a time stamp. Today I checked my database, and I had a lot of weird requests. Here are a few of them: ...
4
votes
2answers
133 views

The UK Terror Watchdog says this is very difficult in practise, is it?

I saw this quote today in the Guardian David Anderson QC, the terror legislation watchdog commissioned to report on the state of Britain’s surveillance laws in the aftermath of Snowden’s ...
4
votes
2answers
898 views

Log of all processes running on a computer

I'm new to the security domain and I want to ask - Does every program leave an 'imprint' in a log of some kind, in a laptop or a PC - of whatever process it ran. If yes, can they be analysed?
-2
votes
2answers
122 views

Data to be Logged in a Web Application [closed]

What data should be logged in a web application? From all the perspective such as security, user access, data modification, path traveled by a user in application and anything that matters.
2
votes
1answer
232 views

Is intercepted ssh-socks traffic revealing HTTP object count and sizes?

I read an article titled the network is hostile, in which the following is stated: Traffic analysis remains a particular problem: even knowing the size of the files requested by a TLS-protected ...