SANS ISC: 10 signs you might be compromised, and don't even know it

• SANS Site Network
  • Current Site
  • SANS Internet Storm Center
  • Other SANS Sites Help
  • Graduate Degree Programs
  • Security Training
  • Security Certification
  • Security Awareness Training
  • Penetration Testing
  • Industrial Control Systems
  • Cyber Defense Foundations
  • DFIR
  • Software Security
  • Government OnSite Training

SANS ISC InfoSec Forums

In light of the upcoming month of Incident Handling, I thought it would be good to start with Step 0 and that is Detection.  Before you ever begin your incident handling process, you have to know you are compromised.  Sometimes its readily apparent and sometimes it isn't.  However, there are some indicators that are often ignored or not thought of having "malicious" possibilities.  These reports can be big clues and often go unchecked.  Here are some of these ideas, in no particular order, yet are good indicators that something may be amiss.

1. Your logging server hasn't logged any events or you haven't received alerts in the last 12 hours
2.  Your FTP server/user hard drives etc. are suddenly out of disk space or maybe logs increase in size more than your normal variation
3. Your competition's products looks just like yours, but have a prettier color scheme
4. Your customers start receiving spam on email addresses they used only to sign up for your service
5. You get machine acts "funny" report from users (i.e. windows closing by themselves, browser homepage changed, etc.)
6. Someone needs help connecting to the company's wireless access point, you don't have a wireless access point
7. Complaints that software (payment processing software, web browser, etc) keeps crashing
8. Complaints from user(s) that passwords/logins aren't working
9. Computer systems running unusually slow
10. Visitors to your website complain that they get redirected to another site or one that just doesn't "look" right

If you have other indicators that you have encountered in the past that have clued you in to a compromise, please let us know and we'll update the list.