Restore a Safe Program

Part of the Investigating a Breach section of Coddy's Cybersecurity journey. Lesson 14 of 20.

Security tools can flag an approved program by mistake. Before restoring it, check why the team considers it safe.

In this example, the checkout file matches the approved fingerprint:

seclab inspect artifacts demo-checkout

Look for these lines:

demo-checkout:
  Expected SHA-256: 4125d1bea8300c9ebd82e5784cd29d37543aa50d5ce9d3a3939d706bac5d94e9
  Quarantined: yes
  SHA-256: 3358a9c63994031abd6bfbb552b26ddd531b58560b2510c146980cdf94f23192

The release record also confirms that this exact version is approved. Restore the file:

seclab artifact demo-checkout restore

You should see:

demo-checkout: restored.

Restoring makes the file usable again. It does not start the process. Start that separately:

seclab process demo-checkout start

You should see:

demo-checkout: running.

The process now says running. Do not restore an unwanted file just to make an error disappear. The approved reference and the investigation should support the decision.

Challenge

Easy

Ticket from Sam, IT lead

The service desk quarantined checkout-service by mistake. Read its release record and compare its fingerprint with the approved reference. Restore the approved service and make checkout work again. Keep the roastery helper and its copy quarantined and stopped.

Try it yourself

Terminal

All lessons in Investigating a Breach

1Follow the Evidence

Running Programs Parent Processes File Fingerprints Save the Evidence Another Report

4Prove the Recovery

Check Normal Work Watch for a Return Write the Findings Return to Service The Stock Room

2Make the Cleanup Last

Stop the Program Quarantine the File Startup Entries Test the Restart The Returning Program

3Work Out What Happened

Build a Timeline Did Data Leave?Find Another CopyRestore a Safe ProgramThe Contractor’s Report