The Returning Program

Part of the Investigating a Breach section of Coddy's Cybersecurity journey. Lesson 10 of 20.

Challenge

Medium

Ticket from Sam, IT lead

The roastery reports a new label template download. Investigate roastery-pc and save evidence while the unwanted program is running. Stop it before customer data leaves, prevent it from returning, and test the cleanup through a restart and the later retry. Keep the approved backup and checkout working.

Try it yourself

Terminal

All lessons in Investigating a Breach

1Follow the Evidence

Running Programs Parent Processes File Fingerprints Save the Evidence Another Report

4Prove the Recovery

Check Normal Work Watch for a Return Write the Findings Return to Service The Stock Room

2Make the Cleanup Last

Stop the Program Quarantine the File Startup Entries Test the RestartThe Returning Program

3Work Out What Happened

Build a Timeline Did Data Leave?Find Another Copy Restore a Safe Program The Contractor’s Report