Hot answers tagged

4

It is not a threat per se, but can be an indication of something unexpected. For example, HTTPS runs on port 443. If someone starts a rogue HTTPS server on port 10443, for example, it could be used for data exfiltration. Or it could be a development environment running there, with insecure settings. It is not expected to run HTTPS on port 10443, so finding ...


3

Some, non-exhaustive reasons a legit server might operate on a non-standard port: A development instance that nobody should connect to by accident. A low-privileged app that can't listen on ports below 1024 A second server of a type that already is running on the same host (e.g. you could have a "normal" web server on 80/443, and another one that ...


1

When I ran into the phrase "threat hunting" 5 years ago, I was confused. It was being treated as, and talked about, as some sort of highly specialised activity requiring special skills and techniques. But I saw it as the basic, fundamental activity of a security analyst: you review the logs, look for anomalies, and chase down things that don't look ...


1

How exactly hunting differs from SIEM Use case To simply break this down and answer this question above, when you handle alerts & events with SIEMS it involves a reactive approach. Whereas for Threat Hunting, it harness a more proactive approach. Basically aiming to be a step ahead of threats instead of being on the receiving end of them. Just this ...


1

This depends on a lot of factors, like: vendor of the IDS, the settings, which signature is being triggered and what kind of attack is being initiated. In short yes, UTMs of the common vendors (CP, Fortinet, PANW) all store a copy of the traffic in memory for analysis. For instance, you could configure in an IDS that a RDP Brute-force attack is only flagged ...


1

There are some great platforms in this arena, the first I ever heard of, SecurityOnion. It's still great after all these years There are also other platforms such as Malcom and VAST that have different perspectives.


Only top voted, non community-wiki answers of a minimum length are eligible