Intrusion Auditing Under Windows NT.pptVIP

Intrusion Auditing Under Windows NT Catching Greg Hoglund - Part II By JD Glaser jdglaser@ Overview NT Behavior Tools I use New tools I have written Useful techniques My Morning E-Mail Message JD, You’re hosed Greg Race is on Change passwords Assemble a toolkit from burned CD of known good tools Begin looking for damage Initial Assertions Start reading my logs Lots of log activity. Cant verify for certain a time/date/logon range No odd server names - COULD BE FORGED THOUGH Im not running IIS on this box - Cross that off Must have sniffed a password. Common Problem - Strong PD