RA5302: Restore Modified File

Summary

ID	RA5302
Brief Description	Restore all files that could have been altered by the attacker
Author	@SEC
Creation Date	2023/05/20
References	https://github.com/certsocietegenerale/IRM/blob/main/EN/IRM-2-WindowsIntrusion.pdf
Response Stage	Recovery

Description

Restore all files that could have been altered by the attacker