Baseline Comparison
Definition
Comparison of a recovered system's current state, including running processes, network connections, scheduled tasks, and file hashes, against a known-good reference state captured before or immediately after a clean rebuild. Deviations from baseline indicate residual compromise or misconfiguration.
- Field
- Incident response / recovery validation
- Compares
- Current system state vs. known-good reference
- Elements checked
- Processes, network connections, scheduled tasks, file hashes
- Purpose
- Detect residual compromise or misconfiguration
Common questions
When should the reference baseline be captured?+
Ideally before an incident occurs, or immediately after a verified clean rebuild, so it reflects a state known to be free of the compromise being investigated. A baseline captured too late may already include artefacts of the intrusion it is meant to rule out.
What does a deviation from baseline actually prove?+
It flags a difference worth investigating, not automatic proof of compromise, since legitimate patching, updates, or configuration changes also produce deviations. The investigator still has to determine whether each difference is malicious, benign, or simply expected drift.
Related terms
- Extended Monitoring Window
- A defined period of heightened detection sensitivity following recovery, during which security operations maintain increased logging, alert thresholds, and analyst attention. Ends...
- Honeytoken
- A synthetic credential, document, or data record placed in a monitored location. Any attempt to use or access the honeytoken is an...
- Recovery Validation
- The verification process that confirms a restored system is clean, correctly configured, and free from residual attacker access. Distinct from eradication, which...
- Recurrence
- Re-establishment of attacker access or re-execution of the same attack vector after the prior incident has been eradicated. Recurrence triggers the incident...
- Tripwire
- A deliberately placed artefact or detection rule designed to fire only if an attacker returns or residual malware reactivates. Examples include canary...