SECURITY INCIDENT SURVEY CHEAT SHEETFOR SERVER ADMINISTRATORS
Tips for examining a suspect system to decide
whether to escalate for formal incident response.

Assessing the Suspicious Situation
To retain attacker’s footprints, avoid taking actions thataccess many files or installing tools.

arp –a,netstat –nr

List network
connections andrelated details

netstat –nao,
netstat –vb,
net session, net use

Look at autostart services

chkconfig --list (Linux),
ls /etc/rc*.d (Solaris),smf (Solaris 10+)lusrmgr, net users,
net localgroup administrators,
net group administrators

List processes

ps aux (Linux, BSD),
ps -ef (Solaris),
lsof +L1

List users andgroups

Look at system, security, and application logs for
unusual events.

Look at scheduled jobs

schtasks

Look at auto-start programs

msconfig

Look at network configuration details and connections;note anomalous settings, sessions or ports.

List processes

Look at the list of users for accounts that do not belong
or should have been disabled.

List services

Look at a listing of running processes or scheduled jobs
for those that do not belong there.
Look for unusual programs configured to run
automatically at system’s start time.
Check ARP and DNS settings; look at contents of thehosts file for entries that do not belong there.
Look for unusual files and verify integrity of OS andapplication files.
Use a network sniffer, if present on the system oravailable externally, to observe for unusual activity.
A rootkit might conceal the compromise from tools;
trust your instincts if the system just doesn’t feel right.
Examine recently reported problems, intrusion
detection and related alerts for the system.

If You Believe a Compromise is Likely...

Check DNS
settings and thehosts filetaskmgr,
wmic process list fullnet start,
tasklist /svc
ipconfig /all,
ipconfig /displaydns,
more %SystemRoot%\
System32\Drivers\etc\hosts
sigverif

Verify integrity of OS files(affects lots of files!)Do not share incident details with people outside theteam responding to the incident.
Avoid sending sensitive data over email or instantmessenger without encryption.
If you suspect the network was compromised,communicate out-of-band, e.g. non-VoIP phones.

Key Incident Response StepsAvoid using Windows Explorer, as it modifies useful filesystem details; use command-line.

Identification: Detect the incident, determine its
scope, and involve the appropriate parties.

3.

Containment: Contain the incident to minimize its
effect on neighboring IT resources.

4.

Eradication: Eliminate compromise artifacts, if
necessary, on the path to recovery.

5.

Recovery: Restore the system to normaloperations, possibly via reinstall or backup.

6.

Wrap-up: Document the incident’s details, retailcollected data, and discuss lessons learned.

Unix Initial System Examination
Look at event log files in
directories (locations vary)/var/log,/var/adm,/var/spool

List recent security events

wtmp, who,last, lastlog

Do not panic or let others rush you; concentrate to
avoid making careless mistakes.

netstat –nap (Linux),
netstat –na (Solaris),
lsof –ieventvwr

Incident Response Communications

2.

Research recently modified
files (affects lots of files!)List network
connections andrelated details

Look at event logs

ls –lat /,find / -mtime -2d -ls

Preparation: Gather and learn the necessary tools,
become familiar with your environment.

arp –an,route print

Windows Initial System Examination

Find recently modified files(affects lots of files!)1.

Examine network
configuration

Take thorough notes to track what you observed, when,and under what circumstances.

Verify integrity of installed
packages (affects lots of files!)dir /a/o-d/p%SystemRoot%\
System32

Involve an incident response specialist for next steps
and notify your manager.

If stopping an on-going attack, unplug the system fromthe network; do not reboot or power down.

rpm -Va (Linux),
pkgchk (Solaris)

Examine network
configuration

List users
Look at scheduled jobs

Check DNS settings
and the hosts file

more /etc/passwd
more /etc/crontab,
ls /etc/cron.*,ls /var/at/jobs
more /etc/resolv.conf,
more /etc/hosts

Other Incident Response Resources
Windows Intrusion Discovery Cheat Sheet
https://dfir.to/windows-intrusion-discovery
Checking Windows for Signs of Compromise
https://dfir.to/windows-signs-of-compromiseLinux Intrusion Discovery Cheat Sheet
https://dfir.to/linux-intrusion-discovery
Checking Unix/Linux for Signs of Compromise
https://dfir.to/linux-signs-of-compromise

Authored by Lenny Zeltser, who leads a security consulting team at SAVVIS, and teaches malware analysis at SANS Institute. Special thanks for feedback to Lorna Hutcheson, Patrick Nolan, Raul Siles,Ed Skoudis, Donald Smith, Koon Yaw Tan, Gerard White, and Bojan Zdrnja. Creative Commons v3 “Attribution” License for this cheat sheet v. 1.8. More cheat sheets?