Support
Incident response on a compromised Windows laptop
A method write-up.
Problem
A Windows machine had been compromised after a social-engineering phone call convinced someone to install remote-access software. Before anything could be wiped or "cleaned", the machine needed a proper look: how the attacker got in, what ran, and what evidence existed. The instinct to reboot and tidy up is the enemy of all three.
Diagnosis
The rules for this job are set by forensics, not convenience: never boot the compromised operating system, never write to the evidence drive, and reconstruct what happened from artefacts rather than memory. The plan was to work against the drive in read-only mode, identify persistence, and sequence events from the filesystem timeline.
Action
- Worked against the drive with strictly read-only block access, so the source state could not change
- Enumerated two independent persistence channels: a consumer remote-support tool, and a cloud-managed RMM agent pushed by the attacker
- Reconstructed a timeline of attacker activity from the NTFS master file table
- Recovered the RMM agent's local policy database, including the uninstall credential it had configured, which made clean removal possible instead of a wipe-and-hope
- Wrote a phased incident report: containment, evidence, findings, remediation
- Moved the laptop to Linux afterwards and gave the user an account with no admin access
Outcome
- Two separate remote-access mechanisms identified and removed
- A reconstructed timeline of the intrusion instead of guesswork
- Clean removal using the agent's own recovered configuration
- A repeatable triage process and report structure for the next incident
What I'd do differently
Pending
Reflection to be written by Jupiter.
0
Open a window and its geometry shows up here.
No events yet.
The desk blanks itself after a quiet spell, then runs one of thirteen effects named after the IRIX screen savers. Move the pointer or press a key to wake it; lock it and only Unlock brings it back.
Settings load with the desktop.
The environment
About this desktop
jupiter.au is set up as a working desktop: the Toolchest, the objects, the status strip and the windows stay with you on every page. Drag a title bar to move a window, pull any edge or corner to resize it, drag it to the side of the desk to snap it into place, and right-click a title bar for that window's menu. Right-click the desk itself for the root menu.
Toolchest
The panel in the corner carries the classic seven menus — Desktop, Find, People, Applications, Shared Resources, System and Help — above the command field. Collapse it to the chip with the arrow in its title strip, or press Ctrl+K to bring it back.
Desks
Four desks, as 4Dwm kept them. Each surface belongs to the desk it was opened on — switch with the status strip, the Toolchest, or Ctrl+Alt+1…4. The Desks Overview window maps all four at once.
The catalogue
The Icon Catalogue lists every application the desk knows — click to select, double-click to open, right-click for the icon's own menu. The objects on the right edge can be dragged into a new order, and the one that will take the drop turns royal blue.
Customise
Desktop → Customise… holds the background (signal wash, flat or dim), the bevels (flat 2026 or the classic two-line), and the way to the Screen Saver. Choices stick to this machine.
Screen saver
Thirteen effects named after the IRIX screen savers, with a timeout, a Random mode and an optional lock. Open the Screen Saver window to change them.
Desks
Four desks, as 4Dwm kept them. Each surface belongs to the desk it was opened on — switch with the status strip, the Toolchest, or Ctrl+Alt+1…4.
Winterm
Type help for the commands — ls, open,theme, date.
Loading the desks…
12 icons shown; sorted by Name
No audio hardware on this host.
Background
Bevels
Screen saver
The timeout, the effect and the lock live in the Screen Saver window.