This cheat sheet captures tips for examining a suspect server to decide whether to escalate for formal incident response. To print, use the one-sheet PDF version; you can also edit the Word version for you own needs.
The steps presented in this cheat sheet aim at minimizing the adverse effect that the initial survey will have on the system, to decrease the likelihood that the attacker's footprints will be inadvertently erased.
If you are an incident handler looking to take on the management of a qualified incident, see the related incident questionnaire cheat sheet.
To retain attacker's footprints, avoid taking actions that access many files or installing tools.
Look at system, security, and application logs for unusual events.
Look at network configuration details and connections; note anomalous settings, sessions or ports.
Look at the list of users for accounts that do not belong or should have been disabled.
Look at a listing of running processes or scheduled jobs for those that do not belong there.
Look for unusual programs configured to run automatically at system's start time.
Check ARP and DNS settings; look at contents of the hosts file for entries that do not belong there.
Look for unusual files and verify integrity of OS and application files.
Use a network sniffer, if present on the system or available externally, to observe for unusual activity.
A rootkit might conceal the compromise from tools; trust your instincts if the system just doesn't feel right.
Examine recently-reported problems, intrusion detection and related alerts for the system.
Involve an incident response specialist for next steps, and notify your manager.
Do not panic or let others rush you; concentrate to avoid making careless mistakes.
If stopping an on-going attack, unplug the system from the network; do not reboot or power down.
Take thorough notes to track what you observed, when, and under what circumstances.
|Look at event logs||eventvwr|
|Examine network configuration||arp –a,|
|List network connections and related details||netstat –nao,|
|List users and groups||lusrmgr,|
net localgroup administrators,
net group administrators
|Look at scheduled jobs||schtasks|
|Look at auto-start programs||msconfig|
wmic process list full
|List services||net start,|
|Check DNS settings and the hosts file||ipconfig /all,|
|Verify integrity of OS files (affects lots of files!)||sigverif|
|Research recently-modified files (affects lots of files!)||dir /a/o-d/p %SystemRoot%\System32|
|Avoid using Windows Explorer, as it modifies useful file system details; use command-line.|
|Look at event log files in directories (locations vary)||/var/log/,|
|List recent security events||wtmp, who,|
|Examine network configuration||arp –an,|
|List network connections and related details||netstat –nap (Linux),|
netstat –na (Solaris),
|List users||more /etc/passwd|
|Look at scheduled jobs||more /etc/crontab,
|Check DNS settings and the hosts file||more /etc/resolv.conf,|
|Verify integrity of installed packages (affects lots of files!)||rpm -Va (Linux),|
|Look at auto-start services||chkconfig --list (Linux),|
ls /etc/rc*.d (Solaris),
smf (Solaris 10+)
|List processes||ps aux (Linux, BSD),|
ps -ef (Solaris),
|Find recently-modified files (affects lots of files!)||ls –lat /,
find / -mtime -2d -ls
Do not share incident details with people outside the team responding to the incident.
Avoid sending sensitive data over email or instant messenger without encryption.
If you suspect the network was compromised, communicate out-of-band, e.g. non-VoIP phones.
Special thanks for feedback to Lorna Hutcheson, Patrick Nolan, Raul Siles, Ed Skoudis, Donald Smith, Koon Yaw Tan, Gerard White, and Bojan Zdrnja.
If you have suggestions for improving this cheat sheet, please let me know.
Creative Commons v3 "Attribution" License for this cheat sheet v. 1.7.
Take a look at my other security cheat sheets.
Copyright © 1995-2013 Lenny Zeltser. All rights reserved. RSS Feed.
The information on this site does not necessarily represent positions or opinions of my employer.