> For the complete documentation index, see [llms.txt](https://karim-ashraf.gitbook.io/karim_ashraf_space/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://karim-ashraf.gitbook.io/karim_ashraf_space/writeups/lets-defend/incident-responder-path/incident-response-on-windows/3-important-things.md).

# 3 Important Things

## **Critical Questions in Compromise Analysis**

When investigating a potentially compromised system, focusing on the following three critical questions ensures a comprehensive and effective response:

***

## **1. Is There Malware Actively Running in the System?**

**Why It Matters:**

Active malware can indicate how the attacker gained initial access and what actions they are currently performing, such as data exfiltration or system manipulation.

**Key Indicators:**

* **Unusual Processes**:
  * Processes with names mimicking legitimate ones (e.g., *svch0st.exe*).
  * Known legitimate processes behaving abnormally, such as **powershell.exe** being executed by **excel.exe**.
* **Suspicious Parent-Child Relationships**:
  * System utilities spawned by non-standard applications.
  * Example: **cmd.exe** or **powershell.exe** spawned from **outlook.exe** or **winword.exe**.
* **Processes in Suspicious Locations**:
  * Executables running from temporary directories, e.g., `/tmp`, `/dev/shm`, `C:\Temp`, or `C:\Users\Public`.

**Actions:**

* **Process Analysis**:
  * **Linux**: Use `ps aux`, `top`, `pstree`, and `lsof`.
  * **Windows**: Use Task Manager, PowerShell (`Get-Process`), or Sysinternals tools like **Process Explorer**.
* **Identify Process Details**:
  * **Command**: `ps aux | grep [process_name]`
  * Investigate parent processes and arguments.
* **Backtrace the Entry Point**:
  * Check logs (e.g., syslog, Windows Event Logs) to see when and how the process was initiated.

***

## **2. Is There Any Suspicious Internal or External Communication?**

**Why It Matters:**

Malware often communicates with external systems for command-and-control (C2), exfiltrating data, or downloading additional payloads.

**Key Indicators:**

* **Connections to Known Malicious IPs or Domains**:
  * Compare external connections with threat intelligence feeds.
* **Unusual Data Transfers**:
  * High-volume data transfers to a single external IP.
  * Unusual transfer protocols (e.g., FTP on non-standard ports).
* **Non-Standard Ports**:
  * Connections over uncommon ports, such as **4444**, **8081**, or high-numbered ports.

**Actions:**

* **Network Connection Analysis**:
  * **Linux**: `netstat -antp`, `ss -tuln`, `tcpdump`, or `iftop`.
  * **Windows**: `netstat -ano`, PowerShell (`Get-NetTCPConnection`), or Sysinternals **TCPView**.
* **Log Review**:
  * Review logs for outbound traffic:
    * **Linux**: `/var/log/syslog`, `/var/log/messages`.
    * **Windows**: Event Logs (look for ID 5156 - network connections).
* **Threat Intelligence Cross-Check**:
  * Compare suspicious IPs/domains against threat databases like VirusTotal or AbuseIPDB.

***

## **3. Is There Any Persistence?**

**Why It Matters:**

Persistence mechanisms enable attackers to maintain access, even after system reboots or disconnection from the network.

**Key Indicators:**

* **Scheduled Tasks or Cron Jobs**:
  * Malicious tasks set to execute periodically.
  * Example: `/etc/cron.d/malicious_job` or hidden entries in **Task Scheduler**.
* **Startup Modifications**:
  * Malicious programs configured to start at boot via:
    * **Windows**: Registry entries under `HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run`.
    * **Linux**: `.bashrc`, `.bash_profile`, or `rc.local`.
* **Hidden Backdoors or Services**:
  * Custom scripts or executables set up as services.
  * Example: `malicious_service` running under `/lib/systemd/system/`.

**Actions:**

* **Scheduled Tasks/Cron Jobs**:
  * **Linux**: `crontab -l`, `cat /etc/crontab`, `ls /etc/cron.*`.
  * **Windows**: `schtasks /query /fo LIST`.
* **Startup Entries**:
  * **Linux**: Inspect `.bashrc`, `.bash_profile`, `rc.local`.
  * **Windows**: Use `regedit` or tools like **Autoruns**.
* **Services**:
  * **Linux**: `systemctl list-units --type=service`.
  * **Windows**: `Get-Service` or `services.msc`.

***

## **Why These Questions Matter**

* **Detect Active Threats**: Identifying running malware enables immediate containment and neutralization.
* **Stop Unauthorized Communication**: Blocking suspicious network activity prevents data exfiltration and disrupts C2 communication.
* **Eliminate Persistence**: Removing persistence mechanisms ensures attackers cannot easily regain access after remediation.

***

## **Immediate Actions Based on Findings**

1. **Active Malware Detected**:
   * **Containment**: Isolate the infected system from the network.
   * **Eradication**: Terminate malicious processes and remove associated files.
2. **Suspicious Communications**:
   * **Block IPs**: Add malicious IPs/domains to the firewall blocklist.
   * **Network Monitoring**: Increase surveillance of unusual outbound traffic.
3. **Persistence Mechanisms Found**:
   * **Disable and Remove**: Stop and delete malicious scheduled tasks, startup entries, or services.
   * **System Hardening**: Apply security patches, enforce least privilege, and monitor for re-entry attempts.

By addressing these three critical questions, incident responders can systematically uncover malicious activity, disrupt ongoing attacks, and secure the system against future compromise.