incident-response

name	incident-response
description	When a machine is infected by malware, analyze the machine and generate a report including observed symptoms, infection vector, and mitigation strategies.

应急响应

尽量断网排查，避免受攻击者干扰，也避免攻击者删除痕迹跑路。

确认受影响机器的现象，用途，操作系统版本，是否有安装安全软件(看告警日志、隔离区)，是否有安全设备如防火墙、态势感知、EDR的告警，以确认排查方向。

应急响应实战笔记 https://bypass007.github.io/Emergency-Response-Notes/