Intrusion Detection is ability of a system to analyze different parameters on a computer system to determine if a system is compromised or not.

learn more… | top users | synonyms

6
votes
8answers
446 views

What is the best strategy for detecting database intrusions?

Filesystem intrusions can be detecting using tools such as Snort but it is more difficult to detect intrusions into a database, such as deletion of rows, modification of tables, etc. What is the best ...
4
votes
3answers
2k views

Comparison of Firewall, Intrusion Prevention, Detection and Antivirus Technologies in Organizational Network Architecture

in these days i'm reading about intrusion prevention/detection systems.When reading i really confused in some points. First, the firewall and antivirus technologies are known terms for years, however ...
4
votes
6answers
598 views

Why is my port 25 so active?

Using netstat -na I notice that I have a lot of connections like tcp 0 0 XXX.XXX.XXX.XXX:25 YYY.YYY.YYY.YYY:13933 ESTABLISHED tcp 0 0 XXX.XXX.XXX.XXX:25 ...
4
votes
3answers
781 views

Is it normal for AD authentication to generate a lot of ICMP traffic?

is it normal for AD authentication between a workstation and AD server to generate a lot of ICMP traffic? I have a network intrusion prevention in place that is constantly detecting huge amount of ...
3
votes
4answers
855 views

Asterisk Intrusion Prevention

Let me start of by saying that I'm a noob, and what I've figured out so far has only been by stumbling my way through it. I have Googled around and the solution may be out there already, but it was ...
3
votes
1answer
586 views

OSSIM In Production Environment

I am trying to get some real-world feedback on OSSIM. Are you using OSSIM in production? If so, what has your overall experiance been? How many nodes are in your enviroment? Finally, what kind ...
3
votes
2answers
208 views

Removing new fingerprint detection message from nmap

I run a nmap scan of my hosts daily to check for open ports. sudo nmap -f -sS -sV --log-errors -append-output -p1-9999 host.com But along with the output I get a long list of fingerprint ...
2
votes
2answers
124 views

Single file changed: intrusion or corruption?

rkhunter reported a single file change on a virtual server (netstat binary). It didn't report any other warning. The change was not the result of a package upgrade (I reinstalled it and the checksum ...
2
votes
4answers
149 views

What response should be made to a continued web-app crack attempt?

I've issues with a continuous, concerted cracking attempt on a website (coded in php). The main problem is sql-injection attempts, running on a Debian server. A secondary effect of the problem is ...
2
votes
5answers
1k views

Utility to notify when website files are changed

Does any one know of a (preferably free) windows utility that recursively hashes all the files in a directory tree every x minutes and sends a notification if any files have changed. I want to have a ...
2
votes
1answer
910 views

AIDE - How to exclude whole folders?

I've recently installed AIDE on a server of mine after having a run in with hackers a week or so ago. There doesn't appear to be much documentation around for AIDE, especially on their website. I've ...
2
votes
1answer
2k views

what tool searches for /w00tw00t.at.ISC.SANS.DFind:)?

In my web server logs I get a lot of these: [error] [client x.x.x.x] client sent HTTP/1.1 request without hostname (see RFC2616 section 14.23): /w00tw00t.at.ISC.SANS.DFind:) I know it's just a failed ...
2
votes
2answers
2k views

aide --init show lots of errors

I have a brand new centos 6.2 server. The first thing I did is yum -y install aide and then next I did aide --init. Below is a whole lot of errors I got.What does it means must I reinstall it? Or ...
2
votes
1answer
176 views

Using a UTM with a Link Aggregrator

I consider changing my office's internet access infrastructure to multilpe ADSL lines aggregated with a link aggregator (Peplink B710). I plan to place my existing UTM (FortiGate-100A) after the ...
2
votes
1answer
242 views

Are random packets normal?

About a month ago on one of my servers I started receiving random packets from IPs all over the world. So I did the smart thing and stopped putting off installing an IDS. This IDS is a ClearOS Gateway ...
1
vote
2answers
560 views

How to find security-leak after a skynet intrusion?

Some days ago, the server of a friend had an intrusion. The attack installed a new SSH daemon that let any valid account in, without providing a valid password. After login, each account automatically ...
1
vote
2answers
107 views

breach in my machine [duplicate]

Possible Duplicate: My server’s been hacked EMERGENCY Suddenly, ssh claims that the key on my server is changed. Even freenx doesn't accept my connections no more because of the changed ...
1
vote
3answers
808 views

What are some of the commonly used rule actions in snort other than the defaults?

I'm writing a strict snort rule parser and I would like to accommodate snort rules from popular plugins. The documentation specifies that any action/type is possible because they can be defined by ...
1
vote
1answer
35 views

NIDS on bridged firewall

I have a firewall (Debian Stable 7.5) which works in bridged mode. The interfaces eth0 (WAN) and eth1 (LAN) are linked with the bridge interface br0. Can I deploy a NIDS (eg. Snort) on this server? ...
1
vote
1answer
238 views

Intrusion detection

I've got a security project regarding the intrusion detection and prevention. I've been googling about it but didn't land up on something substantial. I'm supposed to submit an abstract as of now, I'd ...
1
vote
1answer
2k views

Can snort output an alert for a portscan (sfPortscan) to syslog?

I've been working on this for too long now. I'm sure the answer should be obvious, but... Snort manual: http://www.snort.org/assets/125/snort_manual-2_8_5_1.pdf lists two logging outputs on pg 39 (pg ...
1
vote
3answers
6k views

How to configure sensor rules in OSSIM

we've recently moved our NIDS installation from StrataGuard to the new OSSIM 2.1 release to take advantage of the additional features (Nagios, ntop, Nessus/OpenVas, etc.) it provides in addition to ...
1
vote
3answers
398 views

Simple application level file integrity monitoring & Intrusion detection (IDS)

We've been searching for a simple file integrity monitoring solution on CentOS/Linux that will work on the application level. We are not looking for OS/network level IDS as OSSEC and the others do a ...
1
vote
2answers
352 views

IIS - Script for repeated hacks on a website

I currently have a site that is armored by ELMAH as its reporting mechanism. Each time someone hits a URL that is incorrect it notifies me or logs to the system. This is annoying for someone ...
0
votes
2answers
111 views

last night, my server was doing something intensive with the hard drive

I have an ubuntu server running in my bedroom. It's connected to the internet. Last night, at 5am, it was doing some intensive i/o with the hard drive (I heard it) for like 20 minutes. I don't have ...
0
votes
1answer
241 views

Have I Just Been Hacked? (Intrusion Alert, Known Hacker's Email is Marked as Recipient for an Email in Thunderbird) [closed]

I'm a product creator, and in attempt to track and stem my losses from piracy, I occasionally visit a bulletin board dedicated to piracy and piracy-for-profit; my products are regularly pirated and ...
0
votes
1answer
53 views

Host says server is affected by malware, anyone knows this one ? What to do? [duplicate]

My host sent a notification that says server is infected with a malware, it doesn't seem very popular. The Symantec site about this malware shows windows machines as targets, but not CentOS. Anyone ...
0
votes
1answer
175 views

How can I find out what user from a specified IP is doing with my server?

Yesterday night around 2:00, I occasionally try out a snippet: netstat -ntu | tail -n +3|awk '{ print $5}' | cut -d : -f 1 | sort | uniq -c| sort -n -r | head -n 5 Then it turns out one IP is having ...
0
votes
1answer
563 views

How Does Cisco IPS Work?

How does it work? Does it typically have predefined patterns of trusted or malicious activity? Is it actually a category of firewall techniques? I am more curious about Cisco than I am about other ...
0
votes
2answers
89 views

SecAst: Failing to Ban IP ''

To Generation D: This was the setup at time this issue was observed: secast-1.0.1.0-x86_64-ub12 on Ubuntu 12.04.4 Server LTS with Asterisk 11.10.2. The following events were captured and observed in ...
0
votes
2answers
154 views

Strange entry in Apache log

in my previous post I got something weird in Apache log. Again, I found something strange, but what freaks me out is the response code. It's not 501 anymore, but 200. What do you say? Should I enable ...
0
votes
1answer
463 views

Windows: Audit/View logins from remote networks?

i want to audit remote connection attempts to a Windows 2003 Server. i've changed the group policy to show logon successes and failures: >gpedit.msc Local Computer Policy Computer ...
0
votes
2answers
576 views

AWS EC2: How to determine whether my EC2/scalr AMI was hacked? What to do to secure it?

(See update below) I received notification from Amazon that my instance tried to hack another server. there was no additional information besides log dump: Original report: Destination IPs: ...
0
votes
1answer
23 views

secast init file already exists

I'm installing SecAst on a new computer and I'm on step 2.1.7 (copying init files). I copied the first initd file, but when I copy the second one it says file already exists (and I'm overwriting the ...
0
votes
0answers
67 views

Trouble getting started with the STEALTH monitoring package

Is anyone here familiar with the Linux-based STEALTH package (for monitoring FS integrity of client systems)? I'm trying to get started with a very simple configuration, but I'm running into trouble ...
0
votes
0answers
171 views

SonicWall NSA2400 after firmware upgrade to 5.9 - not able to log some intrusion prevention/detection statements

After upgrading firmware to 5.9 version I'm not able to log intrusion prevention/detection for statements like PHP CGI Argument Injection, Remote Command Execution, Remote File Inclusion, WEB-ATTACKS, ...
0
votes
0answers
32 views

What particularly tools are useful for IDS for a beginner-junior server admin?

I am trying to make sure that I have some intrusion detection tools in place but I'm only a beginner admin and also standing in pending the time a proper admin comes in. I was reading up on IDS and ...
0
votes
0answers
285 views

Event log with thousands of Audit Success events regarding cryptography

I have a Windows Server 2008 R2 Standard running IIS web apps, today the websites were operating fine however when I tried to use Teamviewer on it, it was extremely slow and was losing connection all ...
0
votes
1answer
707 views

How to detect my server is used as a port scanner? [duplicate]

My Web Server is running Ubuntu 12.04.2 LTS with all security updates installed. It is used as a Web Proxy server that handles incoming requests on HTTP/80 HTTPS/443 but also retrieves web content ...
0
votes
2answers
139 views

Remote hosts accessing AD's registry

I have a situation here. I have an intrusion detection system and it constantly alerts me that a remote host is accessing our AD's registry remotely. Our remote hosts are mainly Windows XP and our ...