SO you're talking about making a baseline? On Mon, Jul 16, 2012 at 7:52 PM, Ali Varshovi <ali.varsh...@hotmail.com> wrote: > Hello everybody and thank you for your useful comments. > > Now I'm thinking that we need a comparison base or normal behavior profile to > be able to detect any deviations or abnormal/suspicious activity. While some > known patterns of behaviors are useful to detect malware or backdoors we > still need that normal profile to detect 0-day or APT style intrusions. Isn't > that the same idea from early days of intrusion detection research (anomaly > detection approach)? Or maybe I'm off track. > > Thoughts? > > ------Original Message------ > To: full-disclosure@lists.grok.org.uk > Subject: Linux - Indicators of compromise > Sent: Jul 14, 2012 8:46 AM > > Greetings FD, > > Does anyone have any guidelines/useful material on analysis logs of a Linux > machine to detect signs of compromise? The data collection piece is not a > challenge as a lot of useful information can be captured using commands and > some scripts. I'm wondering if there is any systematic approach to analyze > the collected logs? Most of the materials I've seen are more aligned to > malware and rootkit detection which is not the only concern apparently. > > Thanks, > > Ali > . > --------------------------------------------- > Sent from my BlackBerry device > > _______________________________________________ > Full-Disclosure - We believe in it. > Charter: http://lists.grok.org.uk/full-disclosure-charter.html > Hosted and sponsored by Secunia - http://secunia.com/
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
