Windows Intruder Detection Checklist

This document is being published jointly by the CERT Coordination Center and AusCERT (Australian Computer Emergency Response Team).

• Introduction
• General Advice Pertaining to Intrusion Detection
• Look for Signs that Your System may have been Compromised
  - A Word on Rootkits
  - Examine Log Files
  - Check for Odd User Accounts and Groups
  - Check All Groups for Unexpected User Membership
  - Look for Unauthorized User Rights
  - Check for Unauthorized Applications Starting Automatically
  - Check Your System Binaries for Alterations
  - Check Your Network Configurations for Unauthorized Entries
  - Check for Unauthorized Shares
  - Check for Any Jobs Scheduled to Run
  - Check for Unauthorized Processes
  - Look Throughout the System for Unusual or Hidden Files
  - Check for Altered Permissions on Files or Registry Keys
  - Check for Changes in User or Computer Policies
  - Ensure the System has not been Joined to a Different Domain
  - Audit for Intrusion Detection
  - Additional Information
• Consider Running Intrusion Detection Systems If Possible
  - Freeware/shareware Intrusion Detection Systems
  - Commercial Intrusion Detection Systems
• Review Other AusCERT and CERT Documents
  - Steps for Recovering from a Windows NT Compromise
  - Windows NT Configuration Guidelines
  - NIST Checklists