The Stock Room

Part of the Investigating a Breach section of Coddy's Cybersecurity journey. Lesson 20 of 20.

Challenge

Medium

Ticket from Sam, IT lead

IT has isolated a newly reported warehouse-pc after an unapproved stock label application was installed. Investigate and save evidence while the unwanted process is running. Clean up its process, file and startup, then restore the approved backup. A scheduled restart and retry will follow. Verify that no customer data leaves and checkout still works.

Try it yourself

Terminal

All lessons in Investigating a Breach

1Follow the Evidence

Running Programs Parent Processes File Fingerprints Save the Evidence Another Report

4Prove the Recovery

Check Normal Work Watch for a Return Write the Findings Return to ServiceThe Stock Room

2Make the Cleanup Last

Stop the Program Quarantine the File Startup Entries Test the Restart The Returning Program

3Work Out What Happened

Build a Timeline Did Data Leave?Find Another Copy Restore a Safe Program The Contractor’s Report