RA1130: Prepare Network Activity Profiles

Summary

ID	RA1130
Brief Description	Prepare network activity profiles
Author	@SEC
Creation Date	2023/05/20
References	https://github.com/certsocietegenerale/IRM/blob/main/EN/IRM-2-WindowsIntrusion.pdf
Response Stage	Preparation

Description

A good knowledge of the usual network activity of the machine/server is needed. You should have a file on a secure place describing the usual port activity, to compare efficiently to the current state.