Find Another Copy

Part of the Investigating a Breach section of Coddy's Cybersecurity journey. Lesson 13 of 20.

Renaming a file does not change what is inside it. An unwanted program may appear on another computer under a different name.

Inspect the practice helper’s fingerprint:

seclab inspect artifacts demo-helper

Look for these lines:

demo-helper:
  Expected SHA-256: 40f7e972c40034c1924e56ccbdeabaa292af38232f2f65882a1ae5ab81f34906
  SHA-256: 6f98780313fed4bcc07f7a6adcf6dd348fc56606d1ae6b8d78a0b059cb9943e7

Now inspect a differently named copy:

seclab inspect artifacts spare-tool

Look for these lines:

spare-tool:
  Expected SHA-256: -
  SHA-256: 6f98780313fed4bcc07f7a6adcf6dd348fc56606d1ae6b8d78a0b059cb9943e7

The current SHA-256 values match because the file contents are identical. That gives you a way to find another copy without relying on its name.

A matching fingerprint identifies the same contents. You still need to check where that copy is running and whether it has its own startup entry. Cleaning one computer does not clean another.

Challenge

Easy

Ticket from Sam, IT lead

A file from roastery-pc was copied to label-server under another name. Find the matching file by its current fingerprint and record its ID as copy. Stop its process before its upload succeeds, quarantine the file and disable its startup entry. Keep checkout working.

Try it yourself

Terminal

All lessons in Investigating a Breach

1Follow the Evidence

Running Programs Parent Processes File Fingerprints Save the Evidence Another Report

4Prove the Recovery

Check Normal Work Watch for a Return Write the Findings Return to Service The Stock Room

2Make the Cleanup Last

Stop the Program Quarantine the File Startup Entries Test the Restart The Returning Program

3Work Out What Happened

Build a Timeline Did Data Leave?Find Another CopyRestore a Safe Program The Contractor’s Report