What should I do if I suspect a server has been compromised?
Treat unexplained privileged activity, altered application files or credible security alerts as evidence to investigate, not a reason to erase the server immediately. Coordinate a response that limits further harm and preserves useful information. Use a trusted device and communication route for incident administration.
Before you start
- An authorised incident owner and a trusted way to contact the server and application teams.
Instructions
1. Record the observed evidence
Note what triggered concern, when it occurred and which accounts or services appear affected. Preserve relevant existing alerts, logs and change records through the approved process. Distinguish confirmed facts from guesses and avoid publishing sensitive indicators or customer data in public channels.
2. Contain the confirmed scope
With the incident owner, restrict affected access paths or isolate the relevant server while considering dependent services. Review potentially exposed credentials from a trusted environment and coordinate revocation or rotation. Avoid broad account deletion or log cleanup that could remove evidence or disable unrelated workloads.
3. Investigate before normal operation resumes
Identify the entry point, persistence, affected data and other systems the account could reach. Plan a trusted rebuild or other supported remediation and verify the result before reconnecting. Keep recovery acceptance, monitoring and any required communications with the designated response owners.
Check the result
- The suspected exposure has a named owner, evidence record and containment decision.
- Normal service resumes only after agreed technical and business acceptance checks.
Troubleshooting
- The server appears normal after a reboot
- A reboot does not establish that the cause or persistence is removed. Continue the investigation using the recorded evidence and trusted recovery process.
Official references
Use the documentation for your installed version when a flag, service name or platform feature differs.