Log Sentinel — SOC L1/L2 Threat Triage Dashboard

LS-RULE-001 CRITICAL Wazuh Rule 31106 / 550 (FIM Webshell)

18/Apr/2023:12:43:00 +0000 → 18/Apr/2023:12:51:40 +0000

Web Shell Upload & Execution Detected (DVWA / Unrestricted Upload)

Detected 3 HTTP requests indicating upload and execution of a PHP web shell (e.g. backdoor.php) from 10.0.10.254 on web-server.

Affected Host: web-server

Source IP: 10.0.10.254

Target Account: root / www-data

Correlated Events: 3

MITRE ATT&CK: Persistence / Initial Access • T1505.003 (Server Software Component: Web Shell)

📂 View Forensic Log Evidence (3 samples) & Remediation Playbook

Forensic Log Evidence:

10.0.10.254 - - [18/Apr/2023:12:43:00 +0000] "GET /hackable/uploads/backdoor.php HTTP/1.1" 200 13585
10.0.10.254 - - [18/Apr/2023:12:44:12 +0000] "POST /hackable/uploads/backdoor.php HTTP/1.1" 200 4820
10.0.10.254 - - [18/Apr/2023:12:51:40 +0000] "POST /hackable/uploads/backdoor.php HTTP/1.1" 200 2190

SOC L1/L2 Remediation Playbook:

Isolate the web server and remove malicious PHP scripts from the uploads directory.
Ensure Apache is NOT compiled with -DBIG_SECURITY_HOLE and does not run as root.
Disable PHP execution (php_flag engine off) inside user upload directories.

LS-RULE-002 CRITICAL Wazuh Rule 5712 / 5720

Apr 18 12:35:01 → Apr 19 08:11:18

SSH Brute-Force Followed by Successful Login

Detected 5 failed SSH login attempts from 10.0.10.254 against web-server, followed by 2 successful login(s).

Affected Host: web-server

Source IP: 10.0.10.254

Target Account: admin, root, user1

Correlated Events: 7

MITRE ATT&CK: Credential Access / Initial Access • T1110.001 (Password Guessing)

📂 View Forensic Log Evidence (5 samples) & Remediation Playbook

Forensic Log Evidence:

Apr 18 12:35:01 web-server sshd[2104]: Failed password for invalid user admin from 10.0.10.254 port 49112 ssh2
Apr 18 12:35:04 web-server sshd[2106]: Failed password for root from 10.0.10.254 port 49118 ssh2
Apr 18 12:35:07 web-server sshd[2109]: Failed password for root from 10.0.10.254 port 49124 ssh2
Apr 18 12:52:09 web-server sshd[2341]: Accepted publickey for root from 10.0.10.254 port 50214 ssh2: RSA SHA256:kali@kali
Apr 19 08:11:18 web-server sshd[4102]: Accepted publickey for root from 10.0.10.254 port 54110 ssh2: RSA SHA256:kali@kali

SOC L1/L2 Remediation Playbook:

Block the offending source IP via firewall / Fail2ban.
Audit /root/.ssh/authorized_keys for unauthorized SSH keys (e.g. kali@kali).
Disable PermitRootLogin in /etc/ssh/sshd_config.

LS-RULE-003 HIGH Wazuh Rule 60204 (Multiple Windows Logon Failures)

2023-04-18 12:50:12 → 2023-04-18 12:50:12

Windows RDP/Network Brute-Force Attack (Event ID 4625 -> 4624)

Detected 6 failed Windows logon attempts (Event ID 4625) from 10.0.30.55 (WorkstationName: unknown) on windows-host.

Affected Host: windows-host

Source IP: 10.0.30.55

Target Account: ivanov, kuznecov, petrov, popov, sidorov, smirnov

Correlated Events: 6

MITRE ATT&CK: Credential Access / Lateral Movement • T1110.001 (Password Guessing) / T1021.001 (RDP)

📂 View Forensic Log Evidence (3 samples) & Remediation Playbook

Forensic Log Evidence:

{"EventID": "4625", "TimeCreated": "2023-04-18 12:50:12", "TargetUserName": "ivanov", "IpAddress": "10.0.30.55", "ServiceName": "", "TicketEncryptionType": ""}
{"EventID": "4625", "TimeCreated": "2023-04-18 12:50:12", "TargetUserName": "petrov", "IpAddress": "10.0.30.55", "ServiceName": "", "TicketEncryptionType": ""}
{"EventID": "4625", "TimeCreated": "2023-04-18 12:50:12", "TargetUserName": "sidorov", "IpAddress": "10.0.30.55", "ServiceName": "", "TicketEncryptionType": ""}

SOC L1/L2 Remediation Playbook:

Enforce Account Lockout Policy in Active Directory GPO.
Restrict RDP access by IP and require Network Level Authentication (NLA) + MFA.
Rotate compromised user credentials immediately.

LS-RULE-003 CRITICAL Wazuh Rule 60204 (Multiple Windows Logon Failures)

2023-04-18T12:55:27Z → 2023-04-18T12:55:35Z

Windows RDP/Network Brute-Force Attack (Event ID 4625 -> 4624)

Detected 5 failed Windows logon attempts (Event ID 4625) from 10.0.10.5 (WorkstationName: kali) on ws01.acme.skb, followed by 1 successful logon(s) (Event ID 4624).

Affected Host: ws01.acme.skb

Source IP: 10.0.10.5

Target Account: user1

Correlated Events: 6

MITRE ATT&CK: Credential Access / Lateral Movement • T1110.001 (Password Guessing) / T1021.001 (RDP)

📂 View Forensic Log Evidence (4 samples) & Remediation Playbook

Forensic Log Evidence:

An account failed to log on. Account: user1, Source Network Address: 10.0.10.5, Workstation Name: kali (Brute-RDP.py attempt 1/28)
An account failed to log on. Account: user1, Source Network Address: 10.0.10.5, Workstation Name: kali (Brute-RDP.py attempt 6/28)
An account failed to log on. Account: user1, Source Network Address: 10.0.10.5, Workstation Name: kali (Brute-RDP.py attempt 12/28)
An account was successfully logged on via RDP (LogonType 10). Account: ACME\user1, Source IP: 10.0.10.5 (SSH Tunnel from kali)

SOC L1/L2 Remediation Playbook:

Enforce Account Lockout Policy in Active Directory GPO.
Restrict RDP access by IP and require Network Level Authentication (NLA) + MFA.
Rotate compromised user credentials immediately.

LS-RULE-004 HIGH Wazuh Rule 60115 / Custom Kerberoasting Rule

2023-04-19T09:20:00Z → 2023-04-19T09:20:00Z

Kerberoasting Attack Detected (RC4-HMAC TGS Request - Event ID 4769)

Detected 1 Kerberos TGS ticket request(s) (Event ID 4769) using legacy RC4-HMAC encryption (0x17) targeting service accounts for offline cracking.

Affected Host: dc01.acme.skb

Source IP: 10.0.30.53

Target Account: mssql_svc

Correlated Events: 1

MITRE ATT&CK: Credential Access • T1558.003 (Steal or Forge Kerberos Tickets: Kerberoasting)

📂 View Forensic Log Evidence (1 samples) & Remediation Playbook

Forensic Log Evidence:

A Kerberos service ticket was requested (Event ID 4769). Service Name: mssql_svc, Ticket Encryption Type: 0x17 (RC4-HMAC), Client Address: 10.0.30.53

SOC L1/L2 Remediation Playbook:

Migrate service accounts to Group Managed Service Accounts (gMSA) with 240-char passwords.
Enforce AES128/AES256 Kerberos encryption and disable RC4-HMAC in Domain Policy.

LS-RULE-005 CRITICAL Wazuh Rule 92652 (Pass-the-Hash Activity)

2023-04-19T09:34:29Z → 2023-04-19T09:34:29Z

Pass-the-Hash (PtH) Lateral Movement Detected (Event ID 4624 NTLM)

Detected 1 NTLM network logon(s) (LogonType 3, NtLmSsp, KeyLength=0) to dc01.acme.skb as 'domainadmin' from 10.0.30.53, characteristic of Pass-the-Hash.

Affected Host: dc01.acme.skb

Source IP: 10.0.30.53

Target Account: domainadmin

Correlated Events: 1

MITRE ATT&CK: Lateral Movement / Defense Evasion • T1550.002 (Use Alternate Authentication Material: Pass the Hash)

📂 View Forensic Log Evidence (1 samples) & Remediation Playbook

Forensic Log Evidence:

Pass-the-Hash detected (Wazuh Rule 92652): Account domainadmin logged on to dc01.acme.skb from 10.0.30.53 using NTLM (LogonType 3, NtLmSsp, KeyLength=0).

SOC L1/L2 Remediation Playbook:

Add privileged accounts to the Active Directory 'Protected Users' security group.
Enable Windows Defender Credential Guard (LSA Protection / RunAsPPL) on all domain hosts.
Reset KRBTGT and privileged domain account passwords twice.

LS-RULE-006 CRITICAL Wazuh Rule 62152 / Rule 506

Apr 19 10:15:09 → 2023-04-19T08:13:45Z

Security Monitoring / Windows Defender Tampering Detected

Detected disabling of Microsoft Defender Real-Time Protection (Event ID 5001/5007) and/or termination of the Wazuh SIEM agent service.

Affected Host: web-server

Source IP: local

Target Account: root

Correlated Events: 3

MITRE ATT&CK: Defense Evasion • T1562.001 (Impair Defenses: Disable or Modify Tools)

📂 View Forensic Log Evidence (3 samples) & Remediation Playbook

Forensic Log Evidence:

Apr 19 10:15:09 web-server systemd[1]: Stopping Wazuh agent...
Apr 19 10:15:10 web-server wazuh-agent[1120]: Stopped Wazuh agent (Rule 506).
Microsoft Defender Antivirus Real-Time Protection scanning for malware and other potentially unwanted software was disabled.

SOC L1/L2 Remediation Playbook:

Enable Tamper Protection in Microsoft Defender and enforce settings via GPO.
Configure immediate high-priority SOC escalation on Wazuh Rule 506 (Agent stopped).

LS-RULE-007 HIGH Forensic WER Artifact Correlation

2023-04-19T08:40:12Z → 2023-04-19T08:40:12Z

Forensic Artifact: Deleted LPE Exploit Detected via WER AppCrash

Windows Error Reporting (WER Event ID 1001) recorded an application crash matching a known privilege escalation exploit (e.g. CVE-2019-0623.exe), proving execution even if the attacker subsequently deleted the binary.

Affected Host: ws01.acme.skb

Source IP: local

Target Account: user1

Correlated Events: 1

MITRE ATT&CK: Privilege Escalation / Defense Evasion • T1068 (Exploitation for Privilege Escalation) / T1070.004 (File Deletion)

📂 View Forensic Log Evidence (1 samples) & Remediation Playbook

Forensic Log Evidence:

Fault bucket, type 0. Event Name: APPCRASH. Application Name: CVE-2019-0623.exe. Report archive: C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_CVE-2019-0623.ex_8051a89bf9be3b7c258b25fbbf6b2aa10ef12a6_5625ce51_068f0915-7e50-45f3-b91e-2662535e4f58

SOC L1/L2 Remediation Playbook:

Preserve C:\ProgramData\Microsoft\Windows\WER\ReportArchive\ for forensic analysis.
Apply cumulative Windows kernel security updates (Win32k LPE patches).

LS-RULE-008 CRITICAL Wazuh Rule 62123 / Defender Malware Alert

2023-04-19T09:11:02Z → 2023-04-19T09:11:30Z

Malware / Mimikatz Execution via Redirected RDP Drive (\\tsclient)

Microsoft Defender logged 2 malware/hacktool detection(s) (including HackTool:Win32/Mimikatz.D and Trojan:Win32/Sabsik.TE.A!ml). UNC path analysis reveals execution directly from an attacker-mounted RDP shared drive (\\tsclient\...), exposing the attacker host filesystem.

Affected Host: ws01.acme.skb

Source IP: local

Target Account: user1

Correlated Events: 2

MITRE ATT&CK: Credential Access / Execution • T1003.001 (LSASS Memory) / T1021.001 (RDP Drive Redirection)

📂 View Forensic Log Evidence (2 samples) & Remediation Playbook

Forensic Log Evidence:

Microsoft Defender Antivirus has detected malware: Trojan:Win32/Sabsik.TE.A!ml. Path: file:_C:\Users\Public\Documents\CVEs\cve-2019-1458.exe
Microsoft Defender Antivirus has detected malware or potentially unwanted software: HackTool:Win32/Mimikatz.D. Path: file:_\\tsclient\_home_kali_Documents_Brute-RDP.py_rdpshare_\mimikatz.exe

SOC L1/L2 Remediation Playbook:

Disable RDP Drive Redirection via GPO (Do not allow drive redirection).
Isolate affected workstation and rotate all domain credentials cached in LSASS.

LS-RULE-009 HIGH Wazuh Rule 60116 / Custom AS-REP Roast Detection

2023-04-19T09:18:45Z → 2023-04-19T09:18:45Z

Kerberos AS-REP Roasting Detected (Event ID 4768 PreAuthType 0 / RC4-HMAC)

Detected 1 Kerberos TGT request(s) (Event ID 4768) without pre-authentication (PreAuthType=0) using weak RC4-HMAC encryption (0x17) for account 'legacy_svc@ACME.SKB' from 10.0.30.53, indicating an AS-REP Roasting attack (e.g. GetNPUsers.py / Rubeus).

Affected Host: dc01.acme.skb

Source IP: 10.0.30.53

Target Account: legacy_svc@ACME.SKB

Correlated Events: 1

MITRE ATT&CK: Credential Access • T1558.004 (Steal or Forge Kerberos Tickets: AS-REP Roasting)

📂 View Forensic Log Evidence (1 samples) & Remediation Playbook

Forensic Log Evidence:

A Kerberos authentication ticket (TGT) was requested (Event ID 4768). Account: legacy_svc@ACME.SKB, Pre-Authentication Type: 0 (None), Ticket Encryption Type: 0x17 (RC4-HMAC), Client Address: 10.0.30.53

SOC L1/L2 Remediation Playbook:

Enforce Kerberos Pre-Authentication on all AD accounts (clear 'Do not require Kerberos preauthentication').
Audit domain accounts via: Get-ADUser -Filter 'DoesNotRequirePreAuth -eq $true' and rotate passwords (25+ chars).
Disable RC4-HMAC (0x17) in favor of AES256-CTS-HMAC-SHA1-96 across Active Directory.

LS-RULE-010 CRITICAL Wazuh Rule 92910 (Sysmon Event 10: Process Accessed lsass.exe)

2023-04-19T09:11:31Z → 2023-04-19T09:11:31Z

Sysmon LSASS Memory Credential Dumping Detected (Sysmon Event ID 10)

Sysmon Event ID 10 (ProcessAccess) recorded process '\\tsclient\_home_kali_Documents_Brute-RDP.py_rdpshare_\mimikatz.exe' opening a handle to C:\Windows\System32\lsass.exe with GrantedAccess=0x1010 (PROCESS_VM_READ), directly confirming in-memory credential dumping (Mimikatz sekurlsa::logonpasswords).

Affected Host: ws01.acme.skb

Source IP: 10.0.10.254

Target Account: SYSTEM

Correlated Events: 1

MITRE ATT&CK: Credential Access • T1003.001 (OS Credential Dumping: LSASS Memory)

📂 View Forensic Log Evidence (1 samples) & Remediation Playbook

Forensic Log Evidence:

Process accessed (Sysmon Event ID 10): SourceImage: \\tsclient\_home_kali_Documents_Brute-RDP.py_rdpshare_\mimikatz.exe, TargetImage: C:\Windows\System32\lsass.exe, GrantedAccess: 0x1010 (PROCESS_VM_READ)

SOC L1/L2 Remediation Playbook:

Enable LSA Protection (RunAsPPL=1 in HKLM\SYSTEM\CurrentControlSet\Control\Lsa) and Credential Guard.
Enable Microsoft Defender ASR rule 'Block credential stealing from the Windows local security authority subsystem (lsass.exe)'.
Isolate host immediately and revoke all active Kerberos TGTs / NTLM sessions cached on the endpoint.