What's the best way to handle a possible security breach
You are currently reading a thread in /g/ - Technology
What's the best way to handle a possible security breach through the means of a Meterpreter shell? I did some scanning on my network with Wireshark and discovered unusual interaction between 2 Windows devices on my network and a couple of IP addresses. One of the IP addresses is associated with Shodan, another with SoftLayer VPS services. I took all devices off of the internet and I plan on backing up needed data before wiping both drives. Both IP addresses have been reported on AbuseIPDB for SQL injections, Meterpreter shells, DDoSing, SSH/FTP brute forcing, and more. Besides wiping the drives, what's a good way to find the shell and kill it?
install gentoo
>>54457228
You are the reason God hates us.
>>54457212
You are aware 95% of this board doesn't have a clue about technology?
>>54457212
did you check top
Process explorer, but good shells may unlink their process in the kernel eprocess list. You should be ready to kernel debug and RAM dump/search using volatility. Normally you'd have system visibility tools but you're not Enterprise enough. Full forensic response is probably overkill. If you know how to find and track handles for network connections then you'll be able to find the meterpreter shell or memgrep RAM for the meterpreter DLL then dig around for the associated process.
fuck you faggot kill yourself