Search Results
| Search type | Search syntax |
|---|---|
| Tags | [tag] |
| Exact | "words here" |
| Author |
user:1234 user:me (yours) |
| Score |
score:3 (3+) score:0 (none) |
| Answers |
answers:3 (3+) answers:0 (none) isaccepted:yes hasaccepted:no inquestion:1234 |
| Views | views:250 |
| Code | code:"if (foo != bar)" |
| Sections |
title:apples body:"apples oranges" |
| URL | url:"*.example.com" |
| Saves | in:saves |
| Status |
closed:yes duplicate:no migrated:no wiki:no |
| Types |
is:question is:answer |
| Exclude |
-[tag] -apples |
| For more details on advanced search visit our help page | |
Results tagged with ids
Search options answers only
not deleted
user 140
Intrusion Detection System, a system for detecting and alerting based on behavior.
5
votes
Accepted
What FOSS software do you like to use to build intrusion detection stacks?
http://www.owasp.org/index.php/The_ESAPI_Web_Application_Firewall_%28ESAPI_WAF%29
http://www.owasp.org/index.php/OWASP_AppSensor_Project
http://qosient.com/argus/
http://ourmon.sourceforge.net
- 19.1k
1
vote
Anomaly intrusion detection
That's funny, I was just reading about SPADE yesterday because I had a similar question. I'd be curious to hear more about what you come up with.
Meanwhile, I can point you to some other resources. T …
- 19.1k
1
vote
Do any of you who are *really* dealing with APT have any recommended intelligence feeds for ...
Post HBGary getting owned, it appears that endgames.us offers these services.
Personally, I would go with combining DShield with SHODAN data and start building your own.t
- 19.1k
3
votes
Accepted
How can an IPS be fingerprinted?
You can read more about Active Filter Detection on the PureHacking website. The tool they are discussing is called osstmm-afd, available for download as a source tarball or NASL script. However, since …
- 19.1k
2
votes
EICAR alternative for IDS/IPS
Test My IDS has the output of the Unix `id' command, when run as root. It should alarm an IDS. …
- 19.1k
1
vote
Can I detect web app attacks by viewing my Apache log file?
It may be better to scan your database plan cache (and/or log files) than your web server logs, although certainly it would be good to combine these techniques and match up time and date stamps.
For …
- 19.1k
0
votes
Detecting Pass-the-Hash
You can't really detect or prevent Pass-the-hash attacks. You can discover where on your network Pass-the-hash attacks would be the most destructive.
I have heard of organizations so scared of pass-t …
- 19.1k
0
votes
Evading IDS in exploit development
Agree with Steffen on his first few approaches.
Additionally, I answered a similar question here -- https://security.stackexchange.com/a/83497/140 -- and the technique of using SniffJoke should apply …
- 19.1k
2
votes
Information gathering before deploying a Network IPS
OSSIM is made up of many open-source apps that are great for IDS and IPS. The default inventory provider is OCS Inventory NG. …
- 19.1k
3
votes
What techniques and tools do you use to relate security events?
http://chuvakin.blogspot.com/2011/03/updated-free-log-management-tools.html
The above link lists a few tools which are really going to stick out above others, such as that
Novell Sentinel Log Man …
- 19.1k
0
votes
What is the difference between an anti-virus and an IPS?
Both don't exist anymore because it's not 1999. It's 2019.
AV was replaced by EDR at least by 2013
IPS was replaced by UBA in 2014
What you are looking for are Endpoint Detection and Response plat …
- 19.1k
2
votes
Detecting Process Hollowing
Trustwave SpiderLabs wrote up a blog on analyzing malware with hollow processes -- https://www.trustwave.com/Resources/SpiderLabs-Blog/Analyzing-Malware-Hollow-Processes/
Cuckoo Sandbox, a popular an …
- 19.1k
1
vote
Can OSSEC detect buffer overflow attacks?
If you are looking for detection of stage-one attacks (shellcode in a process) there is EMET, WDEG aka EMET II (for Windows) and Lotan (cross-platform).
Leviathan Security has posted on Lotan at leas …
- 19.1k
20
votes
Accepted
Reduce Noise when Penetration Testing
Can you modify Nmap so that it isn't picked up by IDS or blocked by IPS? Can you use a tool such as sniffjoke with a prepared configuration? …
- 19.1k