Questions tagged [intrusion-detection]
Intrusion Detection is ability of a system to analyze different parameters on a computer system to determine if a system is compromised or not.
9
questions with no upvoted or accepted answers
8
votes
1
answer
344
views
Can Samhain monitor for a file that does not exist, but might in future?
I would like Samhain to monitor a file, say for example, /root/somefile. This file does not currently exist, but I would like to be notified if it gets created at any point.
I add this to samhainrc:
...
1
vote
0
answers
476
views
SonicWall NSA2400 after firmware upgrade to 5.9 - not able to log some intrusion prevention/detection statements
After upgrading firmware to 5.9 version I'm not able to log intrusion prevention/detection for statements like PHP CGI Argument Injection, Remote Command Execution, Remote File Inclusion, WEB-ATTACKS, ...
0
votes
1
answer
181
views
Detecting database breach
I wonder about detecting database breach.
Currently, I use auditd to detect making database dump with mysqldump.
I wonder what more can I do to detect potential database breach.
Thanks for any ideas!
0
votes
0
answers
618
views
Suspicious USB activity on a server
I'm working in a sysadmin team. We manage several servers. All of them are runing Debian (various releases). They are located in a locked cabinet in a datacenter.
Recently I've added logcheck on our ...
0
votes
0
answers
32
views
Need feature name: ethernet switch recognizes manual cable disconnect and shuts down the port
Once in a hospital's radiology department, we had this nifty security feature -- I just cannot remember the proper name to succeed at various search engines:
If a host's ethernet cable was ...
0
votes
1
answer
3k
views
IIS - Detecting Brute Force Logins and Password Spraying
TLDR;
What techniques are being used to detect brute force logins and/or password spraying on IIS hosted websites (including SharePoint, OWA, etc.)?
ModSecurity
There are many tools for other ...
0
votes
1
answer
55
views
Tracking all network access to server made by particular IP
Is there any way that I can track any network access (on any port) made to my server by a particular IP? I'm on Ubuntu Server 16.04 LTS and am using uncomplicated firewall.
Preferably, I'd be able to ...
0
votes
2
answers
175
views
Remote hosts accessing AD's registry
I have a situation here. I have an intrusion detection system and it constantly alerts me that a remote host is accessing our AD's registry remotely.
Our remote hosts are mainly Windows XP and our ...
-2
votes
1
answer
739
views
FAIL2BAN filters- who can give me filter to block this intrusion?
I see in my mediatemple server maillog endless intrusion. i need to block these ips.
who can help with filter file to match these?
Jan 21 07:51:44 mydomain postfix/smtpd[23505]: SSL_accept error from ...