Skip to main content

Potentially Compromised Host

This alert occurs when Lacework detects a suspicious activity on a host or endpoint may suggest it has been compromised. Various activities, such as unauthorized access attempts, unusual system behavior, or malicious software, may trigger this alert.

Why this Alert is Important​

This alert indicates that unauthorized or malicious activity is occurring on a host or endpoint within your network. This activity could result in serious security breaches, data theft, or system damage if left undetected or unaddressed.

Investigation​

Investigating a potential host compromise involves thoroughly analyzing the affected host or endpoint to identify any signs of unauthorized or malicious activity.

Here are some steps you can leverage for your investigation:

  1. Isolate the affected host from the network to prevent further unauthorized access or activity.
  2. Collect all available information about the host, including system logs, network traffic logs, and other relevant data.
  3. Use forensic analysis techniques to examine the system and identify any signs of unauthorized access or activity. This may include looking for suspicious files, network connections, or system configuration changes.
  4. Run anti-malware scans on the affected host to check for any malicious software or code that may have been installed. Determine how the host was compromised and whether the attack originated from inside or outside the network.

Resolution​

To resolve this alert, you can follow these general steps:

  1. Use anti-malware tools to remove any malicious software or code that may have been installed on the host.
  2. Patch any vulnerabilities in the system that the attacker may have exploited.
  3. Reset all user account passwords on the affected host and any administrative passwords associated with the host.
  4. If necessary, restore the affected host from a known good backup to ensure it is completely free from malicious activity.
  5. Review your organization's security controls to identify any gaps or weaknesses that may have allowed the compromise to occur.
  6. Monitor the host and network for further signs of unauthorized or malicious activity.