RE: Tools to help incident response

["Chris Brown" <chris () get-tuf com>]

Hi Johnny

Why not use a network based IDS/IPS to detect these traffic types?  I know
that McAfee IntruShield, amongst others, will detect (and block if required)
both of these as well as other malicious or unwanted traffic types.

Regards

Chris

-----Original Message-----
From: listbounce () securityfocus com [mailto:listbounce () securityfocus com] On
Behalf Of Johnny Wong
Sent: 13 October 2006 02:30
To: focus-ids () securityfocus com
Subject: Tools to help incident response

Hello,

I am part of the incident response team in my organization. Part of 
our daily task is to respond the virus/worm incidents by remote 
scanning the suspected machines. We have been using Stinger.exe from 
McAfee to do this. The pros of using Stinger are (1) it's 
lightweight, (2) it's command-line executed hence I could use Psexec 
with it. However, Stinger.exe hasn't been updated since May 06, and 
we have encountered situations where it failed to detect newer worm 
variants. Can anyone point me to other lightweight virus/worm 
scanners out there?

Secondly, we have been having problems with P2P software running in 
our networks. Time and again we have to use network logs to trace 
P2P-enabled machines and tell the owners of these machines to 
uninstall the offending software. Is there a scanning tool out there 
that can detect the presence of P2P software on a machine?

Thank you all,

J Wong
Singapore


------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it 
with real-world attacks from CORE IMPACT.
Go to
http://www.coresecurity.com/index.php5?module=Form&action=impact&campaign=in
tro_sfw 
to learn more.
------------------------------------------------------------------------


------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it 
with real-world attacks from CORE IMPACT.
Go to http://www.coresecurity.com/index.php5?module=Form&action=impact&campaign=intro_sfw 
to learn more.
------------------------------------------------------------------------