Startup Entries

Part of the Investigating a Breach section of Coddy's Cybersecurity journey. Lesson 8 of 20.

Some programs are set to start when a computer restarts. An attacker can use this to bring an unwanted program back. This is one form of persistence: a way to stay on a computer after the first intrusion.

Inspect the practice computer’s startup entry:

seclab inspect startups demo-start

You should see:

demo-start:
  Process: demo-helper
  Location: /etc/lumen/startup/demo-start
  Enabled: yes

It names demo-helper and says Enabled: yes. Disable that entry:

seclab startup demo-start disable

You should see:

demo-start: disabled. Running processes are unchanged.

Check it again:

seclab inspect startups demo-start

Look for these lines:

demo-start:
  Enabled: no

The entry is disabled, but a running process is unchanged. Cleanup needs to address both the program that is running now and the setting that could bring it back. Keep startup entries for approved work enabled.

Challenge

Easy

Ticket from Sam, IT lead

Review startup entries on design-laptop and support-laptop. Disable the entries that would launch the two unwanted programs again. Keep the browser and backup startup entries enabled so normal work returns after a restart. Both approved backups must still work now.

Try it yourself

Terminal

All lessons in Investigating a Breach

1Follow the Evidence

Running Programs Parent Processes File Fingerprints Save the Evidence Another Report

4Prove the Recovery

Check Normal Work Watch for a Return Write the Findings Return to Service The Stock Room

2Make the Cleanup Last

Stop the Program Quarantine the FileStartup EntriesTest the Restart The Returning Program

3Work Out What Happened

Build a Timeline Did Data Leave?Find Another Copy Restore a Safe Program The Contractor’s Report