Enterprise Cloud Security and Governance

Use case

In the first week of the month, at 7 pm in the evening, there was an alert from OSSEC that the file integrity of the application code had been changed. Since Harsh was managing the IR, he coordinated with the build and release team to check whether there was any recent release and the answer was no.

Harsh logged in to the affected system and checked the last log status and found no one logged in to the server since the past few days. He then opened the index.php file and found strange code residing inside it. He quickly checked the latest index.php from the master branch of the Git repository and confirmed that the code is modified and index.php was indeed modified.