Questions tagged [intrusion-detection]

Intrusion Detection is ability of a system to analyze different parameters on a computer system to determine if a system is compromised or not.

9 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
8 votes
1 answer
344 views

Can Samhain monitor for a file that does not exist, but might in future?

I would like Samhain to monitor a file, say for example, /root/somefile. This file does not currently exist, but I would like to be notified if it gets created at any point. I add this to samhainrc: ...
Richard Downer's user avatar
1 vote
0 answers
476 views

SonicWall NSA2400 after firmware upgrade to 5.9 - not able to log some intrusion prevention/detection statements

After upgrading firmware to 5.9 version I'm not able to log intrusion prevention/detection for statements like PHP CGI Argument Injection, Remote Command Execution, Remote File Inclusion, WEB-ATTACKS, ...
JackTheKnife's user avatar
0 votes
1 answer
181 views

Detecting database breach

I wonder about detecting database breach. Currently, I use auditd to detect making database dump with mysqldump. I wonder what more can I do to detect potential database breach. Thanks for any ideas!
Miłosz Ryćko-Bożeński's user avatar
0 votes
0 answers
618 views

Suspicious USB activity on a server

I'm working in a sysadmin team. We manage several servers. All of them are runing Debian (various releases). They are located in a locked cabinet in a datacenter. Recently I've added logcheck on our ...
jlecour's user avatar
  • 256
0 votes
0 answers
32 views

Need feature name: ethernet switch recognizes manual cable disconnect and shuts down the port

Once in a hospital's radiology department, we had this nifty security feature -- I just cannot remember the proper name to succeed at various search engines: If a host's ethernet cable was ...
Twonky's user avatar
  • 101
0 votes
1 answer
3k views

IIS - Detecting Brute Force Logins and Password Spraying

TLDR; What techniques are being used to detect brute force logins and/or password spraying on IIS hosted websites (including SharePoint, OWA, etc.)? ModSecurity There are many tools for other ...
phbits's user avatar
  • 226
0 votes
1 answer
55 views

Tracking all network access to server made by particular IP

Is there any way that I can track any network access (on any port) made to my server by a particular IP? I'm on Ubuntu Server 16.04 LTS and am using uncomplicated firewall. Preferably, I'd be able to ...
Ben Wilkinson's user avatar
0 votes
2 answers
175 views

Remote hosts accessing AD's registry

I have a situation here. I have an intrusion detection system and it constantly alerts me that a remote host is accessing our AD's registry remotely. Our remote hosts are mainly Windows XP and our ...
smitty user's user avatar
-2 votes
1 answer
739 views

FAIL2BAN filters- who can give me filter to block this intrusion?

I see in my mediatemple server maillog endless intrusion. i need to block these ips. who can help with filter file to match these? Jan 21 07:51:44 mydomain postfix/smtpd[23505]: SSL_accept error from ...
alex K's user avatar
  • 1