[Day 2] 4. Extra

Who is the first responder?
- The first responder is the person who first identifies and reports a potential cyber incident. They are responsible for initiating the incident response process, securing the crime scene, and ensuring that evidence is preserved without tampering.
How do you know that your system is hacked?
- Indicators of a hacked system include:
  - Unusual system behavior or degraded performance.
  - Unexpected or unauthorized changes to files or settings.
  - Presence of unknown or suspicious processes.
  - Alerts from security tools (antivirus, firewall, etc.).
  - Unexpected network traffic or connections to unknown IPs.
  - Unusual login activity or failed login attempts.
What will you do if your hard disk gets suddenly full (possibly hacked with unnecessary files created)?
- Steps to take:
  - Disconnect the system from the network to prevent further damage.
  - Identify the large or unnecessary files using file analysis tools.
  - Check for unauthorized processes or applications that may have generated the files.
  - Preserve evidence by taking a disk image before removing any files.
  - Scan for malware and investigate logs to identify the source of the attack.
  - Seek professional assistance if required.

Authentication Cookie: Stores user session information, often including a unique session ID, expiration time, and sometimes limited user preferences.
War Driving: The act of searching for open or vulnerable Wi-Fi networks while moving through an area, often using a device with Wi-Fi capability.
Net Stumbler: A Windows-based tool used for detecting wireless networks and their details, often for troubleshooting or war-driving.
Windows Registry: Use paths like
```
HKEY_LOCAL_MACHINE\SYSTEM
```
to find system configuration details such as hardware, software, and user settings.