Tagged Questions
0
votes
2answers
79 views
Remote hosts accessing AD's registry
I have a situation here. I have an intrusion detection system and it constantly alerts me that a remote host is accessing our AD's registry remotely.
Our remote hosts are mainly Windows XP and our ...
3
votes
4answers
542 views
Asterisk Intrusion Prevention
Let me start of by saying that I'm a noob, and what I've figured out so far has only been by stumbling my way through it. I have Googled around and the solution may be out there already, but it was ...
0
votes
2answers
104 views
last night, my server was doing something intensive with the hard drive
I have an ubuntu server running in my bedroom. It's connected to the internet. Last night, at 5am, it was doing some intensive i/o with the hard drive (I heard it) for like 20 minutes. I don't have ...
1
vote
2answers
445 views
How to find security-leak after a skynet intrusion?
Some days ago, the server of a friend had an intrusion. The attack installed a new SSH daemon that let any valid account in, without providing a valid password. After login, each account automatically ...
1
vote
1answer
192 views
Intrusion detection
I've got a security project regarding the intrusion detection and prevention. I've been googling about it but didn't land up on something substantial. I'm supposed to submit an abstract as of now, I'd ...
0
votes
1answer
381 views
Windows: Audit/View logins from remote networks?
i want to audit remote connection attempts to a Windows 2003 Server. i've changed the group policy to show logon successes and failures:
>gpedit.msc
Local Computer Policy
Computer ...
0
votes
2answers
453 views
AWS EC2: How to determine whether my EC2/scalr AMI was hacked? What to do to secure it?
(See update below)
I received notification from Amazon that my instance tried to hack another server. there was no additional information besides log dump:
Original report:
Destination IPs:
...
4
votes
3answers
1k views
Comparison of Firewall, Intrusion Prevention, Detection and Antivirus Technologies in Organizational Network Architecture
in these days i'm reading about intrusion prevention/detection systems.When reading i really confused in some points.
First, the firewall and antivirus technologies are known terms for years, however ...
1
vote
3answers
692 views
What are some of the commonly used rule actions in snort other than the defaults?
I'm writing a strict snort rule parser and I would like to accommodate snort rules from popular plugins. The documentation specifies that any action/type is possible because they can be defined by ...
2
votes
5answers
804 views
Utility to notify when website files are changed
Does any one know of a (preferably free) windows utility that recursively hashes all the files in a directory tree every x minutes and sends a notification if any files have changed.
I want to have a ...
3
votes
1answer
518 views
OSSIM In Production Environment
I am trying to get some real-world feedback on OSSIM.
Are you using OSSIM in production?
If so, what has your overall experiance been?
How many nodes are in your enviroment?
Finally, what kind ...
5
votes
8answers
397 views
What is the best strategy for detecting database intrusions?
Filesystem intrusions can be detecting using tools such as Snort but it is more difficult to detect intrusions into a database, such as deletion of rows, modification of tables, etc. What is the best ...
