Finding Malicious Indicators
Students will examine a network breach and be able to identify the indicators of a compromise using a variety of command line and GUI (graphical user interface) utilities that will provide detailed information about the attacker’s foothold into a compromised Windows Server.
Overview
In this lab, you will get an opportunity to examine a system that was and is still actively compromised by an attacker. You have likely read articles in the news or heard from your professors about some of the various high-profile attacks where large companies had systems compromised. It is important to be able to look at a system and know how to examine it in order to determine if the system has been compromised. There are utilities that are built into the operating system as well as third-party utilities that can be utilized to help you determine if a system is compromised. Some of the common tasks that be performed to check for a system compromise include examining network connections, file time stamps, viewing the registry, and dumping and examining the RAM of the system. This lab will help you learn about the possible indications of a compromised system.
OUTCOMES
In this lab, you will learn to:
- Examined a compromised system’s connections, processes, and memory.
- Examine timestamps to find instances of potential breaches.
- Use Wireshark to capture and examine network traffic.