Incident Response

Host-Based Tools

These tools are the host-level counterparts of the network tools previously described. However, instead of collecting and analyzing network-level events, these tools are designed to work at a host level on an individual computer system. They are used to learn things about specific system information that is useful when handling an incident. The applicability of these tools to incident response includes the following tasks:

Attack diagnosis

A common requirement in incident response is to try to diagnose how something could have happened. Frequently, you won’t have all of the event logging information that you need in order to definitively say how an intruder was able to compromise a system. At that point, you’ll need to do some forensic and diagnostic work. We discuss disk-level forensics separately, but one form of forensics is host-level analysis and diagnosis. Having tools that search for host-level vulnerabilities, back doors, and inadequate patch installation is essential. They speed up the analysis process as well as make it more thorough.

Detection of malicious code or back doors

As we’ve already discussed, intruders often leave malicious software behind on a compromised system for a variety of reasons, not the least of which is to facilitate continued exploitation of a system or network. It’s been our experience that one of the most common things for an intruder to do is to try to hide a setuid system shell in a place where it is unlikely to be found by a ...