SANS Incident Handler's Handbook and PICERL Methodology
Phase 2: Identification – SANS Incident Handler's Handbook and PICERL Methodology

SANS Incident Handler's Handbook and PICERL Methodology I-4: I-4 Check Unix hosts for root processes, unlinked files, SUID and large files, promiscuous interfaces, cron jobs, UID 0 accounts and logs

The handbook's Unix template, following the SANS Linux cheat sheet: examine processes (ps, lsof by PID and processes using unlinked files, attention to UID 0); search for files with root set-user-ID permissions, very large files and files with no owner; check for interfaces in promiscuous mode and unexpected listening ports or ARP entries (a sign of sniffers or rogue access points); review root and system-wide cron jobs for logic bombs or unknown connections; list accounts with UID 0; read the logs under /var/log for unusual logins and missing entries; and compare uptime, memory and disk use against expectations.

Maintained by Gerard BlokdykControl text last updated

Other controls in Phase 2: Identification – SANS Incident Handler's Handbook and PICERL Methodology

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll SANS Incident Handler's Handbook and PICERL Methodology controls