Focus on Logs and Files
Not only should you pay attention to the operating system logs, but you should also focus on the files on the operating system. A comprehensive investigation should be conducted to avoid carelessness. Many attack behaviors may not be reflected in the logs, such as scanning tools uploaded by attackers (like fscan), which may remain in the operating system.
Analyze Linux Command History
In Linux systems, the history command can be used to view the command execution history of users. If an attacker has executed commands, this is crucial for identifying their behavior patterns. As defenders, it is also necessary to regularly review the ~/.bash_history file to ensure that no sensitive information (such as passwords, keys, etc.) is left behind and to consider regularly cleaning the history. Additionally, the auditd tool can be used to monitor command execution, ensuring that every command's execution is traceable.
Log Analysis
In addition to operating system logs, Windows users should also pay attention to application system logs, such as those from Apache, IIS, SQL Server, etc. These logs can provide more information about system behavior, helping to identify potential security threats.
Trojan Virus Scanning
On Windows systems, antivirus software can be uploaded and used to scan for potential virus files. At the same time, tools like D Shield can be used to scan for Webshells to detect and remove malicious code.
Organized Thinking
During the emergency response process, thoughts should remain clear, and problems should be investigated step by step. In-depth analysis of the attacker's thought process can help trace their activity trajectory and identify the source of the attack.
Screen Recording
If necessary, screen recording software can be uploaded on Windows systems to record the entire operation for evidence collection. This can provide important evidence for post-analysis.
Tools
The use of tools is crucial in emergency response, such as process analysis tools and Everything. If a report is received about a malicious IP, you can search for the corresponding application related to that IP, which may lead to new discoveries. With the IP, you can submit it to threat intelligence platforms to check if it has any threat labels, and also perform whois queries and reverse IP lookups to see if there is any registration or domain information.
Timeline
The timing of the incident is crucial for clarifying the context of the event. By analyzing the timeline, you can better reconstruct the scenario of the incident, helping to formulate effective emergency response strategies. It is recommended to use timeline tools to visualize the sequence of events and combine them with log records to quickly identify key time points and related events.