Incident Response For Common Attack Types

By /

Listen to this Post

Featured Image

1. Brute Forcing

Details:

Attackers attempt to guess passwords by trying multiple combinations.

Threat Indicators:

  • Multiple login failures in a short time.

Where To Investigate:

  • Active Directory logs (Get-WinEvent -LogName Security on Windows).
  • Application logs (/var/log/auth.log on Linux).
  • System logs (Event Viewer on Windows, `journalctl` on Linux).

Possible Actions:

  • Disable the account (net user [bash] /active:no on Windows).
  • Block attacker IP (iptables -A INPUT -s [bash] -j DROP on Linux).

2. Botnets

Details:

Compromised servers used for DDoS or malicious activities.

Threat Indicators:

  • Suspicious outbound connections.
  • Unusual high traffic.

Where To Investigate:

  • Network traffic (tcpdump, Wireshark).
  • Process logs (ps aux, `top` on Linux; `tasklist` on Windows).

Possible Actions:

  • Isolate server (ifconfig eth0 down on Linux).
  • Kill malicious processes (kill -9 [bash]).

3. Ransomware

Details:

Malware encrypts files and demands ransom.

Threat Indicators:

  • AV alerts.
  • Strange file modifications.

Where To Investigate:

  • AV logs (ClamAV, Windows Defender logs).
  • File integrity checks (tripwire, `AIDE` on Linux).

Possible Actions:

  • Isolate infected machine (airgap).
  • Restore from backups (rsync, Veeam).

4. Data Exfiltration

Details:

Unauthorized data transfer to external sources.

Threat Indicators:

  • High outbound traffic.
  • Connections to cloud storage.

Where To Investigate:

  • Proxy logs (Squid, Zscaler).
  • USB device logs (udevadm monitor on Linux).

Possible Actions:

  • Block exfiltration (iptables -A OUTPUT -p tcp --dport 443 -j DROP).

5. Compromised Account

Details:

Unauthorized account access.

Threat Indicators:

  • Off-hours logins.
  • Unusual privilege changes.

Where To Investigate:

  • AD logs (Get-ADUser -Identity [bash]).
  • SSH logs (/var/log/secure on Linux).

Possible Actions:

  • Reset password (passwd [bash] on Linux).

6. Denial of Service (DoS/DDoS)

Details:

Overwhelming system resources.

Threat Indicators:

  • Spike in traffic.

Where To Investigate:

  • Firewall logs (ufw, iptables).
  • NetFlow data (nfdump).

Possible Actions:

  • Rate-limiting (iptables -A INPUT -p tcp --dport 80 -m limit --limit 25/minute --limit-burst 100 -j ACCEPT).

You Should Know:

  • Brute Force Mitigation: Use `fail2ban` (fail2ban-client status sshd).
  • Ransomware Recovery: Test backups regularly (tar -czvf backup.tar.gz /critical_data).
  • Botnet Detection: Monitor cron jobs (crontab -l).
  • Data Loss Prevention: Encrypt sensitive files (gpg -c file.txt).

What Undercode Say:

Proactive logging (auditd, SIEM tools) and network segmentation reduce attack impact. Always verify backups and enforce least privilege.

Expected Output:

  • Brute Force: Blocked IPs, disabled accounts.
  • Ransomware: Isolated systems, restored files.
  • DDoS: Filtered malicious traffic.

Prediction:

AI-driven attack automation will increase, requiring adaptive defense mechanisms like behavior-based IDS.

(Relevant URL: Druva Ransomware Workshop)

IT/Security Reporter URL:

Reported By: Dharamveer Prasad – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅

Join Our Cyber World:

💬 Whatsapp | 💬 Telegram

Related Posts: