Advanced Incident Response

What to Do If You Think You Have Been Hacked: Advanced Investigation

A practical, command-line guide for examining Windows, macOS, and Linux systems when suspicious activity has been reported.

Advanced security guide Windows, macOS, and Linux Read-only triage Incident response

Suspicious activity does not automatically prove that a system has been hacked. A slow computer, unfamiliar process, failed login, or unexpected network connection can have many explanations.

The purpose of advanced triage is to establish facts without destroying evidence. You are looking for relationships between accounts, processes, network connections, persistence mechanisms, authentication events, and recent changes.

This is not a substitute for professional incident response. If sensitive information, administrator credentials, financial systems, ransomware, or multiple devices may be involved, preserve what you can and request assistance early.

Investigation before cleanup

Do not immediately delete suspicious files, clear logs, kill every unfamiliar process, or reinstall the operating system. Those actions may remove the information needed to understand what happened.

01 / Preparation

Before you start

A calm and repeatable process is more useful than running dozens of commands without recording the results.

Protect credentials

Use a known-clean device for account changes

If an account may be compromised, use a different device that you trust to change passwords, revoke active sessions, and enable multifactor authentication.

Prioritize these accounts

Email, administrator accounts, VPN, cloud services, financial systems, password managers, and any account that reused the same password.

Containment

Decide whether the device should be isolated

If there is strong evidence of active compromise, disconnect the device from Ethernet or Wi-Fi. If possible, coordinate this with whoever manages the network so useful logs and context are not lost.

Do not destroy evidence

Disconnecting a system is different from wiping it. Preserve the device and its state until an investigation plan exists.

Documentation

Record the original symptoms

Write down who noticed the activity, when it was noticed, which device or account was involved, and what was observed before anyone made changes.

  • Local date, time, and time zone
  • Device name and user account
  • Exact error messages or popups
  • Suspicious email, file, process, or connection
  • Actions already taken

02 / Investigation method

A practical investigation path

The goal is to move from the original report toward verifiable facts. Start broad, then investigate the systems and events that deserve closer attention.

Advanced incident investigation workflow The investigation moves from documenting symptoms to preserving evidence, inspecting identity, processes, network connections, persistence, logs, and finally deciding whether escalation is required. Investigate without destroying evidence Document Preserve Inspect Correlate Decide Symptoms Times Logs Screenshots Accounts Processes Network Timeline Contain Escalate A suspicious signal becomes more useful when supported by related evidence.
A good investigation connects endpoint, identity, network, and log evidence instead of relying on one alarming symptom.

The triage sequence

Collect the same categories on every platform

Windows, macOS, and Linux use different commands, but the questions are similar.

Identity

Who is logged in?

Identify the current user, local accounts, administrator membership, recent logins, and unexpected authentication events.

Execution

What is running?

Look for unfamiliar processes, unusual paths, recently launched programs, and processes running with elevated privileges.

Network

What is communicating?

Compare listening services and active connections with expected applications, destinations, ports, and business activity.

Persistence

What starts automatically?

Review scheduled tasks, services, login items, startup folders, cron jobs, and other mechanisms that launch programs automatically.

03 / Windows

Windows investigation commands

Open PowerShell as an administrator when a command requires elevated access. Run commands in a controlled order and save the output with the time it was collected.

Windows note: Some event logs and account details require an elevated PowerShell session. Do not clear Event Viewer logs while investigating.

Windows / System identity

Establish the system and current user

Get-Date
hostname
whoami
whoami /all
Get-ComputerInfo | Select-Object WindowsProductName, WindowsVersion, OsBuildNumber, CsName
Get-NetIPConfiguration

Look for

  • A hostname or user account that does not match the expected device.
  • Unexpected group membership, especially local or domain administrator privileges.
  • Network adapters, gateways, or DNS servers that do not belong to the organization.
  • A device running a different Windows version or build than expected.

Windows / Processes

Review running processes

Get-Process |
  Sort-Object CPU -Descending |
  Select-Object -First 40 Id, ProcessName, CPU, Path

Get-CimInstance Win32_Process |
  Select-Object ProcessId, ParentProcessId, Name, ExecutablePath, CommandLine |
  Sort-Object Name

Look for

  • Processes running from temporary folders, user profile downloads, or unusual hidden directories.
  • Misspelled versions of legitimate Windows process names.
  • A strange parent-child relationship, such as an office application launching a scripting engine unexpectedly.
  • Command lines containing unfamiliar scripts, encoded arguments, or unexpected remote destinations.

A process name alone is not proof of malicious activity. Verify the executable path, signer, parent process, start time, and whether the software is expected.

Windows / Network

Inspect listening ports and active connections

Get-NetTCPConnection |
  Sort-Object State, RemoteAddress |
  Format-Table -AutoSize

Get-NetTCPConnection -State Listen |
  Sort-Object LocalPort |
  Format-Table -AutoSize

Get-NetTCPConnection -State Established |
  Select-Object LocalAddress, LocalPort, RemoteAddress, RemotePort, State, OwningProcess

Get-NetFirewallProfile |
  Select-Object Name, Enabled, DefaultInboundAction, DefaultOutboundAction

Get-DnsClientServerAddress

Look for

  • Listening ports associated with software that should not accept network connections.
  • Persistent outbound connections to destinations that are not recognized or business-related.
  • Remote administration services that were not intentionally enabled.
  • Disabled firewall profiles or unexpected DNS resolver settings.

To connect a Windows TCP connection to a process, note the OwningProcess value and compare it with the process ID from Get-Process.

Windows / Persistence

Review tasks, services, startup, and accounts

Get-ScheduledTask |
  Where-Object {$_.State -ne "Disabled"} |
  Select-Object TaskPath, TaskName, State

Get-CimInstance Win32_Service |
  Select-Object Name, State, StartMode, StartName, PathName |
  Sort-Object Name

Get-ItemProperty `
  "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run"

Get-ItemProperty `
  "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run"

Get-LocalUser |
  Select-Object Name, Enabled, LastLogon, PasswordLastSet

Get-LocalGroupMember -Group "Administrators"

Look for

  • Scheduled tasks with random names, unusual paths, or triggers that do not match business software.
  • Services configured to run from user-writable or temporary directories.
  • New local users, newly enabled accounts, or unexpected administrator membership.
  • Startup entries pointing to scripts, temporary files, or unfamiliar executables.

Windows / Event logs

Review recent authentication and system events

Get-WinEvent -LogName Security -MaxEvents 100 |
  Select-Object TimeCreated, Id, ProviderName, LevelDisplayName, Message

Get-WinEvent -FilterHashtable @{
  LogName = "Security"
  Id = 4624, 4625, 4672, 4688, 4720, 4728, 4732
} -MaxEvents 200 |
  Select-Object TimeCreated, Id, Message

Get-WinEvent -LogName System -MaxEvents 100 |
  Select-Object TimeCreated, Id, ProviderName, Message

Useful event categories

  • 4624 — successful logon
  • 4625 — failed logon
  • 4672 — special privileges assigned
  • 4688 — process creation when auditing is enabled
  • 4720 — user account created
  • 4728 and 4732 — group membership changes

Pay attention to the account, source address, logon type, time, and whether the event corresponds to a known user or administrative action.

04 / macOS

macOS investigation commands

Terminal commands on macOS can reveal users, processes, network activity, launch agents, launch daemons, login items, and recent authentication events.

macOS note: Modern macOS protects some system locations through privacy controls and system protections. A command returning limited information does not necessarily indicate tampering.

macOS / System identity

Establish the system and current user

date
hostname
whoami
id
sw_vers
uname -a
scutil --get ComputerName
ifconfig
networksetup -listallhardwareports
scutil --dns

Look for

  • A computer name, user, operating system version, or network configuration that does not match the expected device.
  • Unexpected network interfaces, gateways, or DNS resolvers.
  • A user account with administrative privileges that should not have them.

macOS / Processes

Review running processes and executable paths

ps auxww
ps -axo user,pid,ppid,lstart,command
top -o cpu -l 1 -n 20

pgrep -alf "ssh|curl|wget|python|perl|ruby|osascript|bash|zsh"

Look for

  • Processes running from temporary folders, Downloads, hidden directories, or unexpected user locations.
  • Unfamiliar scripting processes launched by an unexpected parent.
  • Programs with long or unusual command lines.
  • Persistent processes that return after being closed.

The final command is only a focused search for commonly used interpreters and tools. It is not a malware detector and should be interpreted alongside the complete process list.

macOS / Network

Inspect connections and listening services

lsof -nP -i
lsof -nP -iTCP -sTCP:LISTEN
netstat -anv -p tcp
scutil --nwi
arp -an

Look for

  • Unexpected services listening on network ports.
  • Repeated outbound connections to unfamiliar hosts.
  • Network connections owned by a process that does not match the application you expect.
  • Remote access services that were not intentionally enabled.

In the lsof output, examine the command name, process ID, local endpoint, remote endpoint, and connection state together.

macOS / Persistence

Review launch agents, daemons, and login items

launchctl print-disabled system
launchctl print-disabled user/$(id -u)

find ~/Library/LaunchAgents \
  /Library/LaunchAgents \
  /Library/LaunchDaemons \
  -type f -maxdepth 2 -print 2>/dev/null

ls -la ~/Library/LaunchAgents
ls -la /Library/LaunchAgents
ls -la /Library/LaunchDaemons

osascript -e 'tell application "System Events" to get the name of every login item'

crontab -l 2>/dev/null

Look for

  • Launch files with random names or unusual executable paths.
  • Startup items that execute from a user-writable directory.
  • Login items that were not installed by an expected application.
  • Cron entries that run scripts or programs at unexpected times.

A launch item is not automatically malicious. Check its owning application, file signature, creation time, and whether the user recognizes it.

macOS / Authentication and logs

Review recent logins and security-relevant events

last -20
lastlog 2>/dev/null

log show --last 24h --style compact \
  --predicate 'process == "sshd" OR eventMessage CONTAINS[c] "authentication"'

log show --last 24h --style compact \
  --predicate 'eventMessage CONTAINS[c] "login" OR eventMessage CONTAINS[c] "sudo"'

log show --last 24h --style compact \
  --predicate 'process == "launchd" OR process == "securityd"'

Look for

  • Logins at times when the user was not present.
  • Repeated authentication failures followed by a successful login.
  • Unexpected use of SSH, sudo, or administrative authentication.
  • Launch services appearing around the time suspicious activity began.

05 / Linux

Linux investigation commands

Linux systems vary by distribution and service manager. The commands below cover common systemd-based distributions and standard Linux utilities.

Linux note: Run commands with sudo only when necessary. Reading logs with elevated privileges is different from changing system configuration.

Linux / System identity

Establish the host, user, kernel, and network

date
hostnamectl
whoami
id
uname -a
cat /etc/os-release
ip addr
ip route
resolvectl status 2>/dev/null || cat /etc/resolv.conf

Look for

  • Unexpected hostnames, users, distributions, or kernel versions.
  • New network interfaces, routes, gateways, or DNS resolvers.
  • Local users with unexpected privileges or shell access.

Linux / Processes

Review running processes and command lines

ps auxf
ps -eo user,pid,ppid,lstart,cmd --forest
top -b -n 1 | head -40

sudo lsof -nP -i 2>/dev/null
sudo ls -l /proc/[0-9]*/exe 2>/dev/null

Look for

  • Processes running from /tmp, hidden directories, or unexpected home-directory paths.
  • Processes running as root without an obvious system purpose.
  • Strange parent-child relationships or commands with unusual arguments.
  • Executables whose link target no longer exists or points to an unexpected location.

Linux / Network

Inspect sockets, ports, routes, and connections

sudo ss -tulpn
sudo ss -tpna
sudo lsof -nP -iTCP -sTCP:LISTEN
ip route
ip neigh

Look for

  • Listening services that are not expected on the host.
  • Established connections to unfamiliar or suspicious destinations.
  • Services bound to all interfaces when they should only be available locally.
  • Unexpected routes or gateway changes.

In ss -tulpn, compare the listening address, port, process, and service owner. A port number alone does not establish that a compromise occurred.

Linux / Persistence

Review services, timers, cron, and shell startup

systemctl list-units --type=service --state=running
systemctl list-unit-files --state=enabled
systemctl list-timers --all

crontab -l 2>/dev/null
sudo crontab -l 2>/dev/null

find /etc/cron* /var/spool/cron /var/spool/cron/crontabs \
  -type f -maxdepth 3 -print 2>/dev/null

grep -RniE 'curl|wget|nc|ncat|python|perl|bash|sh' \
  ~/.profile ~/.bashrc ~/.bash_profile \
  /etc/profile /etc/profile.d 2>/dev/null

Look for

  • Newly enabled services or timers with unfamiliar names.
  • Cron jobs that execute scripts from temporary or hidden directories.
  • Startup files that download, decode, or execute unexpected content.
  • Persistence that runs as root without a documented purpose.

Linux / Authentication and logs

Review logins, privilege use, and system activity

last -ai | head -50
lastb -ai | head -50 2>/dev/null

sudo journalctl --since "24 hours ago" -p warning..alert
sudo journalctl --since "24 hours ago" \
  | grep -Ei 'sshd|sudo|authentication|failed|accepted|session opened|session closed'

sudo grep -Ei 'accepted|failed|invalid|sudo|session opened|session closed' \
  /var/log/auth.log /var/log/secure 2>/dev/null | tail -100

Look for

  • Successful SSH logins from unfamiliar addresses.
  • Repeated failures followed by a successful authentication.
  • Unexpected use of sudo or root sessions.
  • New sessions around the time a suspicious process or connection first appeared.

06 / Interpretation

What should you look for?

The strongest indicators usually come from multiple related facts, not from one unfamiliar filename or process.

Normal activity pattern A normal event has an expected user, known process, normal destination, and documented time. Expected activity Known user Known process Expected destination Documented
Suspicious activity pattern Suspicious activity may involve an unexpected account, process, destination, and persistence mechanism at a related time. Investigate further Unexpected account Unusual process Unknown destination Related timeline

Identity mismatch

An account appears where it should not

Examples include a successful login at an impossible time, a newly created local administrator, or remote access by an account that does not normally use that system.

Execution mismatch

A process runs from an unusual location

An unfamiliar process deserves closer examination when it runs from a temporary directory, uses an unexpected parent process, or starts around the same time as a suspicious login.

Network mismatch

A system communicates unexpectedly

Pay attention to new listening services, unusual outbound connections, repeated beacon-like activity, and traffic that does not fit the system's role.

Persistence mismatch

Something starts automatically without explanation

A new service, scheduled task, launch agent, timer, cron job, or login item can be important when it appeared near the beginning of the suspicious activity.

Unfamiliar does not mean malicious

Software updates, remote-management tools, backup agents, security products, developer tools, and business applications can all create unfamiliar processes or network connections. Validate before concluding that an event is malicious.

07 / Evidence correlation

Build a timeline

A timeline helps separate confirmed facts from assumptions and shows whether separate events may be related.

1

First observation

Record when the unusual behavior was first noticed and who reported it.

2

Authentication activity

Compare successful and failed logins, administrator use, VPN activity, and remote access.

3

Process execution

Record suspicious process names, paths, parent processes, command lines, and start times.

4

Network communication

Compare local ports, remote destinations, DNS requests, firewall events, and system roles.

5

Persistence or changes

Check whether new services, scheduled tasks, launch items, cron jobs, users, or configuration changes appeared.

6

Decision

Decide whether the evidence supports normal activity, continued monitoring, containment, or professional escalation.

08 / Escalation

When to stop investigating yourself

Command-line triage is useful for collecting initial facts, but some situations require specialist assistance.

Escalate immediately

Request professional incident response

Stop making changes and seek help when any of the following may be true:

  • Administrator or domain credentials may be compromised.
  • Multiple systems show related activity.
  • Ransomware, extortion, or destructive activity is involved.
  • Sensitive, financial, medical, or regulated information may be affected.
  • An attacker appears to have maintained access.
  • You cannot determine whether the system is trustworthy.
  • Legal, insurance, or regulatory reporting may be required.
Preserve before recovery

Do not assume that reinstalling one computer answers how the compromise happened or whether other systems were affected.

09 / Evidence handling

Preserve command output carefully

Investigation results are more useful when they can be connected to a person, system, and time.

Suggested record format

Document every observation

Case:
Device:
Operating system:
User:
Investigator:
Collection date:
Collection time:
Time zone:

Original symptom:
Command or evidence source:
Result:
Why it matters:
Related event:
Action taken:
Next step:

Good evidence notes are specific

Instead of writing “strange connection,” record the process name, process ID, local address, local port, remote address, remote port, state, timestamp, and why the connection was unexpected.

Store screenshots, exported logs, command output, suspicious messages, filenames, and relevant timestamps together. Do not edit the original output; add interpretation in a separate note.

Need help investigating?

Get expert support before the evidence disappears

Managed security monitoring and incident-response assistance can help correlate endpoint activity, authentication events, network connections, firewall logs, DNS requests, and cloud activity.

Request a Security Assessment

The goal is informed action

The presence of an unfamiliar process, port, account, or log entry does not automatically prove that a hack occurred. The strongest conclusion comes from multiple related observations that fit together in time and context.

Preserve evidence, protect important accounts from a known-clean device, isolate a system when appropriate, and escalate when the potential impact is significant. The objective is not simply to find something unusual. It is to determine what happened, how far it may have reached, and what must happen next.