List of visits to the Committees

1. Scope and preparation

The purpose, scope and period of assessment shall be in writing - Which systems, accounts and environments check how far back and what remains outside the scope.
There is a written authorisation to access systems and data - Also employees' e-mails and magazines - personal data processing needs a basis and purpose.
Communication of the assessment takes place in the channel outside the test environment - If an attacker reads an e-mail, the check message warns him before time.
The procedure for gathering and storing evidence is defined in advance - Which collects, stores, records and accesses - so that what you find can be used later.
We know what happens when an active intrusion is found - Who decides on the transition to incident response and who can isolate the systems.

2. Data sources and visibility

There is a list of systems from which logs are available and from which no - Rob also has a gap in magazines in the conclusion - it should be mentioned at the beginning.
The period of storage of magazines covers the entire period to be checked - The attack often starts months before the discovery. The magazine does not see it for seven days.
Systems clocks are synchronized, and time zone is known - Without it, the sequence of events between the systems cannot be assembled.
The number of terminals and servers covered by the monitoring agent is known - Installations without an agent are exactly where the attacker may go unnoticed.
Checked for deletion or suspension of logs - The magazine cleaning, suspended audit service or sudden break is a sign of itself.

3. Identity and access

Revised all privileged accounts and their changes over the period - New administrators, addition to privileged groups and rights whose origin no one can explain.
MFA changes checked - new devices, unsetting, exceptions - The attacker adds his autentiifier to keep access even after the password change.
Checking that accounts of inactive or former employees have not been used - The account, which for months was quiet and suddenly sign up, is one of the strongest signs.
Service accounts are not used for interactive login - Service account with login to workstation or through remote desktop is not designed for behavior.
Checked application from unusual places and times - Two countries in one hour, applying at night or from hosting addresses.
Verified failed applications - Many accounts with one password from one address or one account from many addresses.
Verified domain controller anomalies - Unusual long tickets, replication requests from a non-controller and changes in group policies.

4. Terminals and servers

Revised automatic starting points - Services, planned tasks, launch keys, startup folders, cron, systemd timers and launchd.
Verified unsigned executables in temporary and user folders - Programs starting from download, temporary or user profile folders are the most common place for malware.
Unusual use of built-in tools - A command line with coded parameters, remote execution and tools that the user usually does not call.
Checked for safety tools not excluded or with exceptions - Antivirus stopped, new escape routes or uninstalled agent.
Files tested on web servers other than from placement - New scripts in the public folder is a typical place for permanent access through the browser.
Memory and process verification for critical systems - Some evil disk doesn't appear at all - it only lives in memory.

5. Network

Searched for regular outgoing connections to the same address - Steady rhythm (e. g. every 60 seconds) is a sign of the control channel.
Checked DNA queries on rare, new or long names - Recently registered domains and unusually long subdomains can carry data or commands.
Extraordinarily large amounts of outgoing data checked - Especially at night, on cloud pools or addresses with which the organization does not work.
Verified connections between workstations - Remote desktop, file sharing or remote control between normal workstations is not routine behavior.
Revised EF and remote access sessions - Sessions from unusual countries, simultaneous sessions and connections outside working hours.

6. Cloud and Email

Revised administrative activities in a cloud environment - New access keys, role allocation and actions from unknown addresses.
Checked whether cloud auditing is disabled or changed - Stopped log flow is one of the first attacker activities.
Checked public storage and shared use - also the "everyone with a link" link established during the period under examination.
Verified rules for the transmission of mailboxes and delegations - The rule that transmits or hides letters allows the attacker to read the list without applying.
Revised third party applications with access to accounts - The app permission survives the change of password and MFA - it must be withdrawn separately.

7. External surface and suppliers

Internet service compares with a list of known assets - A service that nobody knows about is also a service that nobody updates.
Checking the vulnerability of edge devices - VPN, firewalls and e-mail gateways - if the patch is applied late, check for entry.
Checked for organisation accounts not in leak data sets - The leaked password without MFA is ready for access.
Revised access routes for suppliers and their use - Remote control tools and supplier accounts are frequent inputs that do not appear in the magazines themselves.
Code repositories checked for open secrets - The key and password in the code history remains after the file has been deleted.

8. Conclusions and next steps

Each field has one result: compromised, not found, cannot judge - "Not found" does not mean "not compromised" if the visibility was incomplete - it is written separately.
The report lists the visibility gaps limiting the conclusion - Logless systems, short storage time and equipment without agent.
The findings are with evidence, time stamps and source - The finding cannot be repeated without proof and cannot pass the test.
Intrusion detected to respond to incidents as planned - With reporting deadlines starting from the opening.
Obstacles of vision have tasks with responsible and deadline - The next assessment is as good as it's repaired.
Date of next assessment - For example, once a year, after a merger or after a serious incident in the industry.