Incident Response for a Hacked ColdFusion Server: A Step-by-Step Containment Guide

Introduction
The first sign is rarely dramatic. A .jsp file in a directory that should only contain CFML. An outbound connection to an address nobody recognises. A cf_scripts request in the web logs that nobody on the team made. Or, most often, an alert from endpoint protection that someone almost dismissed.
Read More