Another Report

Part of the Investigating a Breach section of Coddy's Cybersecurity journey. Lesson 5 of 20.

Challenge

Medium

Ticket from Sam, IT lead

A new report concerns support-laptop. A program is contacting parcel-cache while the approved backup uses Lumen’s archive. Identify the outside connection’s process, its parent and its file. Record them as process, parent and file. Save evidence while that program is still running. Keep the approved backup working.

Try it yourself

Terminal

All lessons in Investigating a Breach

1Follow the Evidence

Running Programs Parent Processes File Fingerprints Save the EvidenceAnother Report

4Prove the Recovery

Check Normal Work Watch for a Return Write the Findings Return to Service The Stock Room

2Make the Cleanup Last

Stop the Program Quarantine the File Startup Entries Test the Restart The Returning Program

3Work Out What Happened

Build a Timeline Did Data Leave?Find Another Copy Restore a Safe Program The Contractor’s Report