Andrew Martin

In a previous post I discussed using the technique of watching for the transfer of executable files around the network as a method of intrusion detection. This is a great way of discovering machines that were attacked where IDS failed to detect the exploit(s) due to obfuscation. Another method I’d like to highlight is looking [...]

One of the things I constantly keep in mind is “how do I find what I don’t know about?”. An unknown threat is what will hurt you and your organization. So how does one find something they don’t know about? From an intrusion detection perspective, this can be quite easy. Everyone knows (or should know) [...]