https://souljian.cn/tags/%E4%BA%8B%E4%BB%B6%E5%93%8D%E5%BA%94/Recent content in 事件响应 on SoulJian小站Hugo -- gohugo.ioen-usSun, 30 Aug 2026 10:00:00 +0800https://souljian.cn/p/751088129/Sat, 29 Aug 2026 14:00:00 +0800https://souljian.cn/p/751088129/<h2 id="写在前面合法学习边界">写在前面：合法学习边界 </h2><p>应急响应只在授权环境进行。未经授权对系统取证可能触犯法律。</p> <h2 id="一应急响应六步">一、应急响应六步 </h2><img src="https://souljian.cn/img/incident-response-flow.svg" alt="应急响应流程" /> <div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">① 准备 → ② 检测 → ③ 遏制 → ④ 根除 → ⑤ 恢复 → ⑥ 复盘 </span></span></code></pre></td></tr></table> </div> </div><h2 id="二取证关键命令">二、取证关键命令 </h2><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt"> 1 </span><span class="lnt"> 2 </span><span class="lnt"> 3 </span><span class="lnt"> 4 </span><span class="lnt"> 5 </span><span class="lnt"> 6 </span><span class="lnt"> 7 </span><span class="lnt"> 8 </span><span class="lnt"> 9 </span><span class="lnt">10 </span><span class="lnt">11 </span><span class="lnt">12 </span><span class="lnt">13 </span><span class="lnt">14 </span><span class="lnt">15 </span><span class="lnt">16 </span><span class="lnt">17 </span><span class="lnt">18 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl"><span class="c1"># 内存取证</span> </span></span><span class="line"><span class="cl">ps aux · ss -tlnp · lsof -i </span></span><span class="line"><span class="cl"> </span></span><span class="line"><span class="cl"><span class="c1"># 文件取证</span> </span></span><span class="line"><span class="cl">find / -mmin -60 -type f </span></span><span class="line"><span class="cl">ls -la /tmp /dev/shm </span></span><span class="line"><span class="cl"> </span></span><span class="line"><span class="cl"><span class="c1"># 日志取证</span> </span></span><span class="line"><span class="cl">/var/log/auth.log · /var/log/secure </span></span><span class="line"><span class="cl">journalctl -u sshd --since <span class="s2">&#34;1 hour ago&#34;</span> </span></span><span class="line"><span class="cl"> </span></span><span class="line"><span class="cl"><span class="c1"># 持久化检查</span> </span></span><span class="line"><span class="cl">cat /etc/crontab · crontab -l </span></span><span class="line"><span class="cl">systemctl list-units --all </span></span><span class="line"><span class="cl"> </span></span><span class="line"><span class="cl"><span class="c1"># 网络取证</span> </span></span><span class="line"><span class="cl">tcpdump -i eth0 -w capture.pcap </span></span><span class="line"><span class="cl">netstat -antp </span></span></code></pre></td></tr></table> </div> </div><h2 id="三遏制措施">三、遏制措施 </h2><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">隔离受感染主机 · 断开网络连接 </span></span><span class="line"><span class="cl">阻止攻击扩散 · 保留现场证据 </span></span></code></pre></td></tr></table> </div> </div><h2 id="四小结">四、小结 </h2><p>应急响应核心是<strong>快速遏制 + 保留证据 + 根除威胁</strong>。事前准备工具和方法论，事后复盘总结经验教训。</p>https://souljian.cn/p/751088162/Sat, 29 Aug 2026 14:00:00 +0800https://souljian.cn/p/751088162/<h2 id="写在前面合法学习边界">写在前面：合法学习边界 </h2><p>应急响应只在授权环境进行。未经授权对系统取证可能触犯法律。</p> <h2 id="一应急响应六步">一、应急响应六步 </h2><img src="https://souljian.cn/img/incident-response-flow.svg" alt="应急响应流程" /> <div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">① 准备 → ② 检测 → ③ 遏制 → ④ 根除 → ⑤ 恢复 → ⑥ 复盘 </span></span></code></pre></td></tr></table> </div> </div><h2 id="二取证关键命令">二、取证关键命令 </h2><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt"> 1 </span><span class="lnt"> 2 </span><span class="lnt"> 3 </span><span class="lnt"> 4 </span><span class="lnt"> 5 </span><span class="lnt"> 6 </span><span class="lnt"> 7 </span><span class="lnt"> 8 </span><span class="lnt"> 9 </span><span class="lnt">10 </span><span class="lnt">11 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl"><span class="c1"># 内存取证</span> </span></span><span class="line"><span class="cl">ps aux · ss -tlnp · lsof -i </span></span><span class="line"><span class="cl"> </span></span><span class="line"><span class="cl"><span class="c1"># 文件取证</span> </span></span><span class="line"><span class="cl">find / -mmin -60 -type f · ls -la /tmp /dev/shm </span></span><span class="line"><span class="cl"> </span></span><span class="line"><span class="cl"><span class="c1"># 日志取证</span> </span></span><span class="line"><span class="cl">/var/log/auth.log · journalctl -u sshd </span></span><span class="line"><span class="cl"> </span></span><span class="line"><span class="cl"><span class="c1"># 持久化检查</span> </span></span><span class="line"><span class="cl">cat /etc/crontab · crontab -l · systemctl list-units </span></span></code></pre></td></tr></table> </div> </div><h2 id="三遏制措施">三、遏制措施 </h2><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">隔离受感染主机 · 断开网络连接 </span></span><span class="line"><span class="cl">阻止攻击扩散 · 保留现场证据 </span></span></code></pre></td></tr></table> </div> </div><h2 id="四小结">四、小结 </h2><p>应急响应核心是<strong>快速遏制 + 保留证据 + 根除威胁</strong>。事前准备工具和方法论，事后复盘总结经验教训。</p>