Application, deployment, backend services, API

Applications, content

Operating system, content, applications, services

Storage, networking, hardware

strings

cat

findstr

Get-Strings

Business team

Security team

Systems administrator

Data owner

Preparation, containment, eradication, recovery, retaliation,

and lessons learned

Preparation, identification, recovery, encapsulation,

eradication, and lessons learned

Preparation, identification, containment, eradication,

recovery, and prosecution

Preparation, identification, containment, eradication,

recovery, and lessons learned

The localgroup was being added to the administrators

group.

The list of user accounts in the administrators group

was being displayed.

The list of user accounts in the localgroup and

administrators group was being displayed.

Info was being displayed for the localgroup and

administrators user accounts.

Reformat, reinstall, and patch the system from the

original media

Patch and reboot the compromised system

Restore the OS from the most recent backup

Install applications from a different vendor

Regshot event log

Switch access log

Windows event log

Proxy access log

find.exe

csrss.exe

services.exe

lsass.exe

It provides verification of breached data access.

It helps to understand the scope of the breach and the

actions taken by an attacker.

It helps to provide detailed insight into network activity for

analysis.

It provides full packet capture visibility.

s3logparse.py useragent sec504-erk20*

aws ec2 describe-volumes | jq -r '.Volumes[] | select (

.AvailabilityZone | contains("us-east-1") ) | .VolumeId'

aws s3 describe-logs | parse

basicblobfinder.py -get-all-blobs