Showing 13–24 of 26 articles
Page 2 of 3
What to do when you think an account has been taken over
Regaining the password is only the start of account recovery. Check active sessions, recovery details, mailbox rules, connected applications, and the device used to sign in.
Read the visual guide
What to do with a bank or payment alert you did not start
An alert might describe real account misuse or be part of a scam itself. Use the service’s established app or a trusted contact number to distinguish the two.
Read the visual guide
What to do with a USB stick you do not recognise
An unknown USB device is not just an unexplained set of files. Connecting it can expose a computer to unexpected hardware behavior as well as unsafe content.
Read the visual guide
What to do when someone says your computer is infected
An alarming pop-up or unsolicited caller may claim your computer is infected. Do not grant remote access or make a payment on that person’s instructions.
Read the visual guide
What to do in the first hour after you click a bad link
What happened after the click matters. Simply opening a page, entering a password, approving a request, and running a file call for different responses.
Read the visual guide
Detection engineering: turn a threat idea into an actionable alert
An alert needs more than a matching indicator. Connect the behavior you want to detect to available telemetry, a tested rule, an owner, and a clear response.
Read the visual guide
DDoS attacks: distinguish bandwidth floods from application overload
A service can fail because the network link is saturated or because expensive application requests consume its resources. The appropriate mitigation depends on where capacity is exhausted.
Read the visual guide
Incident logs: collect the evidence that answers your questions
A useful log source answers a specific incident question. Start with identities, affected services, and the actions you need to reconstruct, then preserve the records with their time context.
Read the visual guide
Living-off-the-land activity: spot misuse of legitimate tools
A familiar administration tool can be part of an intrusion. Judge its execution by the account, parent process, command context, destination, and business reason.
Read the visual guide
Web shells: remove the attacker’s access, not just one file
An unexpected server-side script may provide an attacker with continuing access. Removing that file is only one step; you also need to understand how it arrived and what else changed.
Read the visual guide
Business email compromise: verify bank changes before paying
A convincing invoice can arrive from a real but compromised mailbox. Protect the payment decision with independent verification of changes to the beneficiary or account details.
Read the visual guide
Stolen session cookies: why a password reset may not end access
A session cookie can let a browser continue using an account after sign-in. If a session is stolen, changing the password may not revoke every active session or connected application.
Read the visual guide