Sure enough, less then two minutes later system logs indicate the system is compromised, as our attacker initiates a connection and logins to the box. Our intruder has gained super user access and now controls the system. We will now begin our forensic analysis and put the pieces together, step by step. Black-hats normally start with information gathering, they need to determine what vulnerabilities exist before they can strike. If your system has been compromised, this is normally not the first time the black-hat has communicated with that system.
Most attacks involve some type of information gathering before the attack is launched.
So, this is where we will start, the black-hat's information gathering stage. If we look at the alert above, the attack was on port 53. This indicates a DNS attack was launched on our system. We find a DNS version query probe coming from the same system that attacked us. Our system was attacked April 26, from the same system.