How do we check a suspicious computer without tipping off the attacker?

Observe before you act, and then act all at once. An attacker who notices you looking may delete evidence, move to another machine or start encryption early, so avoid noisy steps, such as resetting the user's password or running a full scan, before you have a plan. First collect what you can quietly: the endpoint console's history, firewall and DNS logs, and the connections the computer makes. Decide with your incident-response provider which accounts and hosts to contain, then do it together: isolate, reset credentials from a clean device and block the attacker's destinations within the same short window. Work from a clean device, and do not discuss the incident over a mailbox that may be compromised. A NetSenX sensor on a SPANSPAN: switch port analyser. A switch setting that sends a copy of network traffic to one port, where a sensor can watch it. or TAPTAP: test access point. A small device that copies the traffic on a network cable for a sensor to watch. port observes without touching the computer, and its alerts list the destinations, timing and volume a containment plan needs.

← All 35 questions on Have I been hacked?All topics