Noticing intrusion.
WHAT TO WATCH FOR
Unexpected processes Unexpected network connections, particularly outbound New accounts or keys Modified files Scheduled tasks you did not create Unusual resource use
THAT LAST ONE
Compromised servers are frequently used for someone else's computing, which shows as load.
WHAT TO MONITOR
Authentication, successful and failed Changes to critical files Outbound connections
WHY OUTBOUND
A compromised system communicates outward, and that is frequently the first visible sign.
WHAT TO CHECK PERIODICALLY
Accounts and keys Scheduled tasks What is listening
WHAT TO DO ON SUSPICION
Preserve evidence before changing anything Isolate the system Assume every credential on it is compromised
WHAT NOT TO DO
Clean it and continue.
WHY
Without finding the entry point, it returns.
WHAT TO PREFER
Rebuilding from a known-good state, with the entry point closed.
WHAT TO CHECK IN BACKUPS
Whether they already contain the compromise.
