3 ms·
It's a game of cat and mouse. As someone that works on detection content, I would consider patterns I consider false postivie a secret. Because potential attack
by _8j50 4y ago
It's a game of cat and mouse. As someone that works on detection content, I would consider patterns I consider false postivie a secret. Because potential attackers can otherwise craft their payloads and techniques to go undetected.
For example, if you consider a nikto or openvas user-agent a false positive when detecting for specific traffic anomalies all one has to do is use those user-agents and evade detection.
That said, I do appreciate and use things like MISP warning-lists with care.
- ycluo 4y agoregarding something like virus total I think advanced hackers do also verify there first before attack to evade. I feel NoiseTotal is useful. But probably it should be gated to people within a small community. (for example only share between universities or healthcare) Making it completely public is risky. What do you think?