What They Left Behind

Part of the Security Fundamentals section of Coddy's Cybersecurity journey. Lesson 40 of 43.

Signing an attacker out may not remove everything they set up. They could have created another account to use later, or added a rule that sends them copies of new invoices. These ways of keeping access are called persistence.

For example, suppose the account-creation log shows that the attacker created report-agent. Once you have saved the evidence, delete that account:

seclab delete report-agent

You should see:

Deleted report-agent. The account and its group memberships are gone for good.

Also check for forwarding rules they added to existing accounts. Be careful with service accounts: these are accounts used by programs for jobs such as backups. A name you do not recognize is not proof of an attack. Use the logs and approval records to decide what to remove.

Challenge

Easy

Ticket from Sam, IT lead

The affected staff accounts are disabled. The logs show another account and a mail rule created by the attacker. Remove both before the next invoice is copied outside. Remove the affected employee's temporary admin rights from the system move too. Keep the approved backup service, newsletter sorting rule and disabled staff records.

Try it yourself

Terminal