If you detect activity on port 3389 (the mouse starts moving) What is the first steps you should take from a security standpoint, and who should be notified?
You've got two choices:
- Cut and run
- Dig deeper
Option 1 involves physically unplugging the machine from the network, then treating it as hostile. It's been infected, therefore it's no longer your computer. Grab whatever files you need from it via a live CD, and wipe the drive. Make sure to run an up-to-date AV over the files you copy, just in case they've been infected with anything. This especially includes documents (.doc, .pdf, etc), as well as scripts and executables, as they're a common target these days.
Option 2 involves potentially losing data, and giving the attacker time to do nasty things with your computer / network. Grab a bunch of tools (Wireshark / Process Explorer) and work out what the hell is going on.
- Store the Wireshark
.pcapdump on a removable drive for later analysis.
netstat -anto get a full list of active TCP connections / listeners.
- Launch Process Explorer, save the process list to a file, then dig around in anything that looks unusual.
- Do a memory dump of potentially infected / malicious processes using ProcDump, with the following command:
procdump -mp <pID>Save the dumps somewhere safe.
- Shut down the machine, load it into a live CD, then manually analyse the registry and file system using forensics tools.
I highly recommend option 1 for safety, but the second option will provide you with a better idea of who the attacker is and what they're up to.
The first thing you should do is physically disconnect the computer from the network. You might think simply "pulling the plug" would be better from the security point of view and you'd be right. However, by pulling the plug you lose valuable forensic data. You should then notify the person responsible for IT Security of your computer. If that person is you, then you should start a forensics investigation to find out how this happened, why and how to prevent it from happening in the future. Comment if you'd like to know more.