Emergency-Response-Notes
应急响应实战笔记，一个安全工程师的自我修养。
A Chinese-language security reference covering computer intrusion response for Windows and Linux: detecting webshells, analyzing logs, identifying attacker persistence techniques, and walking through real ransomware and cryptomining case studies.
Emergency Response Notes is a Chinese-language reference collection for security engineers who need to investigate and handle computer intrusion incidents. The author describes it as personal study notes built up from real case analysis, covering the full arc from discovering that a system was compromised through to cleaning it up.
The content is organized into six chapters. The first covers intrusion investigation on both Windows and Linux systems, including how to detect webshells (files attackers plant on web servers to maintain access) and how to respond to ransomware infections. The second chapter is about log analysis, covering Windows event logs, Linux system logs, web server logs, and database logs from MySQL and MSSQL.
The third chapter addresses persistence techniques, meaning the methods attackers use to keep access even after a victim reboots or patches. It covers hidden files and backdoors on both Windows and Linux, file download methods, and common webshell management tools used by attackers. The fourth and fifth chapters walk through practical Windows and Linux case studies, including FTP brute-force attacks, trojan viruses, ransomware, cryptomining malware, DDoS infections, and rootkits.
The sixth chapter focuses on web-specific incidents: sites that had webshells injected, sites hijacked to serve cryptomining scripts, bulk defacement attacks, hijacking of news sources and mobile traffic, search engine hijacking, and administrator account tampering.
The project is defensive in nature. The intended reader is a security professional or aspiring security engineer who wants case-based guidance on what to look for and how to contain damage after a breach. The README is in Chinese, and the full content is published as a GitBook site.
Where it fits
- Follow structured incident response steps for a compromised Windows or Linux server, from initial detection through cleanup and hardening.
- Learn how to analyze Windows event logs, Linux system logs, and web server access logs to trace an attacker's activity timeline.
- Study real case studies of ransomware, cryptomining malware, DDoS infections, and rootkits to recognize the same patterns in your own environment.