# 应急响应流程
1. 准备阶段
– 建立应急响应团队
– 制定应急响应计划
– 准备应急工具
– 定期演练

2. 识别阶段
– 检测安全事件
– 确认事件类型
– 评估影响范围
– 记录事件信息

3. 遏制阶段
– 隔离受影响系统
– 阻止攻击扩散
– 保留证据
– 恢复业务

4. 根除阶段
– 清除恶意软件
– 修复安全漏洞
– 加固系统安全
– 验证修复效果

5. 恢复阶段
– 恢复系统服务
– 验证系统功能
– 监控系统状态
– 恢复业务运营

6. 总结阶段
– 分析事件原因
– 评估响应效果
– 改进安全措施
– 更新应急计划

# 应急响应联系人
$ cat > /etc/security/contacts.txt << 'EOF' 安全团from PG视频:www.itpux.com队: security@fgedu.net.cn, 123-456-7890 系统管理员: admin@fgedu.net.cn, 123-456-7891 网络管理员: network@fgedu.net.cn, 123-456-7892 管理层: management@fgedu.net.cn, 123-456-7893 执法部门: 110 EOF

# 收集系统信息
$ cat > /usr/local/bin/collect-evidence.更多视频教程www.fgedu.net.cnsh << 'EOF' #!/bin/bash EVIDENCE_DIR="/var/log/evidence/$(date +%Y%m%d_%H%M%S)" mkdir -p $EVIDENCE_DIR echo "Collecting evidence to $EVIDENCE_DIR..." # 收集系统信息 uname -a > $EVIDENCE_DIR/system-info.txt
uptime >> $EVIDENCE_DIR/system-info.txt

# 收集用户信息
who > $EVIDENCE_DIR/logged-users.txt
last > $EVIDENCE_DIR/login-history.txt
lastb > $EVIDENCE_DIR/failed-logins.txt

# 收集进程信息
ps aux > $EVIDENCE_DIR/processes.txt
pstree -p > $EVIDENCE_DIR/process-tree.txt
lsof > $EVIDENCE_DIR/open-files.txt

# 收集网络信息
ss -tunap > $EVIDENCE_DIR/network-connections.txt
netstat -rn > $EVIDENCE_DIR/routing-table.txt
arp -a > $EVIDENCE_DIR/arp-table.txt

# 收集日志文件
cp -r /var/log/* $EVIDENCE_DIR/logs/

# 收集审计日志
ausearch -m all > $EVIDENCE_DIR/audit-log.txt

# 收集文件系统信息
find / -perm -4000 -type f > $EVIDENCE_DIR/suid-files.txt
find / -perm -2000 -type f > $EVIDENCE_DIR/sgid-files.txt
find / -name “.*” -type f > $EVIDENCE_DIR/hidden-files.txt

# 收集计划任务
crontab -l > $EVIDENCE_DIR/crontab.txt 2>/dev/null
cat /etc/crontab > $EVIDENCE_DIR/etc-crontab.txt
ls -la /etc/cron.* > $EVIDENCE_DIR/cron-directories.txt

# 收集启动项
systemctl list-unit-files –type=service > $EVIDENCE_DIR/services.txt
ls -la /etc/systemd/system/ > $EVIDENCE_DIR/systemd-services.txt

# 创建证据包
tar -czf /tmp/evidence-$(date +%Y%m%d_%H%M%S).tar.gz -C $(dirname $EVIDENCE_DIR) $(basename $EVIDENCE_DIR)

echo “Evidence collected and saved to /tmp/evidence-$(date +%Y%m%d_%H%M%S).tar.gz”
EOF

chmod +x /usr/local/bin/collect-evidence.sh

# 执行证据收集
$ sudo /usr/local/bin/collect-evidence.sh

# 检查可疑进程
$ ps aux | grep -E “nc|netcat|ncat|nmap|masscan|wget|curl” | grep -v grep

# 检查可疑网络连接
$ ss -tunap | grep ESTAB | grep -v “:22\|:80\|:443”

# 检查可疑文件
$ find /tmp /var/tmp /dev/shm -type f -mtime -1

# 检查可疑计划任务
$ grep -r “*” /etc/cron* /var/spool/cron* 2>/dev/null

# 检查可疑启动项
$ systemctl list-unit-files –type=service –state=enabled | grep -v “sshd\|nginx\|mysqld”

# 检查可疑用户
$ awk -F: ‘$3 == 0 {print $1}’ /etc/passwd
$ awk -F: ‘$3 >= 1000 {print $1}’ /etc/passwd

# 检查可疑SSH密钥
$ find /home -name “authorized_keys” -exec ls -la {} \;

# 使用ClamAV扫描
$ sudo clamscan -r -i / –exclude-dir=”^/sys\|^/proc\|^/dev”

# 使用rkhunter扫描
$ sudo rkhunter –check –skip-keypress

# 检查rootkit
$ sudo chkrootkit

# 分析可疑文件
$ file suspicious_file
$ strings suspicious_file
$ md5sum suspicious_file
$ sha256sum suspicious_file

# 检查文件修改时间
$ find / -type f -mtime -1 -ls 2>/dev/null | head -50

# 检查被删除但仍在使用的文件
$ sudo lsof | grep deleted

# 系统恢复步骤
1. 隔离系统
– 断开网络连接
– 禁用可疑服务
– 阻止攻击者访问

2. 备份证据
– 收集系统信息
– 备份日志文件
– 保存恶意文件

3. 清除威胁
– 停止恶意进程
– 删除恶意文件
– 清除后门账户

4. 修复漏洞
– 更新系统补丁
– 修复配置错误
– 加固系统安全

5. 恢复服务
– 恢复系统配置
– 启动系统服务
– 验证系统功能

6. 监控系统
– 监控系统活动
– 检测异常行为
– 记录安全事件

# 系统恢复脚本
$ cat > /usr/local/bin/system-recovery.sh << 'EOF' #!/bin/bash log() { echo "$(date): $1" | tee -a /var/log/recovery.log } isolate_system() { log "Isolating system..." firewall-cmd --panic-on systemctl stop sshd } collect_evidence() { log "Collecting evidence..." /usr/local/bin/collect-evidence.sh } stop_malicious_processes() { log "Stopping malicious processes..." for pid in $(ps aux | grep -E "nc|netcat" | grep -v grep | awk '{print $2}'); do kill -9 $pid done } remove_malicious_files() { log "Removing malicious files..." find /tmp /var/tmp /dev/shm -type f -mtime -1 -exec rm -f {} \; } restore_services() { lo学习交流加群风哥微信: itpux-comg "Restoring services..." firewall-cmd --panic-off systemctl start sshd } verify_system() { log "Verifying system..." rkhunter --check --skip-keypress clamscan -r -i / } main() { isolate_system collect_evidence stop_malicious_processes remove_malicious_files restore_services verify_system log "Recovery completed" } main EO学习交流加群风哥QQ113257174F chmod +x /usr/local/bin/system-recovery.sh