Scenario
Simulated Environment
This study project replicated a SOC Tier 1 investigation scenario. The simulated environment consisted of two target systems: an Ubuntu 22.04 server running Apache 2.4 as a public-facing web application, and a Windows 10 endpoint representing an internal workstation. A simulated attacker (separate Kali Linux VM) conducted a multi-stage intrusion across both hosts over a defined two-hour exercise window.
┌───────────────────────────────────────────────────────────┐ │ Simulated SOC Exercise │ │ │ │ ATTACKER DEFENDER (SOC Analyst Role) │ │ ┌────────────────┐ ┌─────────────────────────┐ │ │ │ Kali Linux │ │ Splunk SIEM │ │ │ │ (attack VM) │ │ (log aggregation) │ │ │ └────────┬───────┘ └──────────┬──────────────┘ │ │ │ attacks │ monitors │ │ ▼ │ │ │ ┌────────────────┐ ┌──────────┴──────────────┐ │ │ │ Ubuntu Web │──logs──► │ Windows Event Collector │ │ │ │ Server │ │ + Apache access/error │ │ │ │ Apache 2.4 │ │ logs forwarded to Splunk │ │ │ └────────────────┘ └─────────────────────────┘ │ │ │ │ │ │ ┌────────┴───────┐ ┌──────────┴──────────────┐ │ │ │ Windows 10 │──logs──► │ Wineventlog (Security, │ │ │ │ Endpoint │ │ System, Application) │ │ │ │ (pivot target) │ └─────────────────────────┘ │ │ └────────────────┘ │ └───────────────────────────────────────────────────────────┘
Logs from both systems were forwarded to a Splunk Free instance for centralised analysis. The exercise objective was to detect the attacker's actions at each stage and produce structured incident response documentation.
Methodology
Analysis Workflow
1 Triage
→
2 Investigate
→
3 Contain
→
4 Document
-
1
Triage — Initial Alert Review
Reviewed Splunk's Notable Events dashboard. Identified elevated failed logon counts on the Windows endpoint and anomalous process creation events on the Apache server. Prioritised alerts by severity and correlated timestamps across both hosts. -
2
Investigate — Deep Log Dive
Pivoted on source IP from the initial brute-force alert. Traced the attacker's progression: web shell upload via a vulnerable file upload endpoint on Apache → lateral movement to the Windows endpoint via SMB → new account creation and privilege escalation → malicious service installation for persistence. Each stage cross-referenced with specific Windows Event IDs. -
3
Contain — Simulated Response Actions
In the lab environment, documented recommended containment actions: isolate the Ubuntu web server from the network segment, disable the newly created privileged account (simulated via net user command), stop and remove the malicious service, revoke SMB access for the compromised credential. In a real environment these would be executed with change control approval. -
4
Document — Structured IR Report
Produced an incident report using a structured template: Executive Summary, Timeline of Events, Technical Findings, MITRE ATT&CK Mapping, Indicators of Compromise (IOCs), and Recommended Remediation. This mirrors the documentation expected in a professional SOC environment.
Log Analysis
Windows Event IDs Referenced
Windows Security and System event logs form the backbone of endpoint investigation. The following Event IDs were the primary data sources used during the investigation phase of this study exercise.
4625
Failed logon attempt — tracks brute-force and credential stuffing
4624
Successful logon — identifies when a credential is accepted
4720
User account created — flags attacker persistence accounts
4732
Member added to security group — local Administrators membership
4688
New process created — process tree tracing, command-line review
7045
New service installed — persistence via malicious service binary
4648
Logon with explicit credentials — pass-the-hash / lateral movement
4776
NTLM authentication — validates credential attempts vs domain
Detection Queries
Sample Splunk SPL Queries
These SPL (Search Processing Language) queries were used during the lab exercise to surface specific attack behaviours from the ingested Windows event logs and Apache access logs.
-- Brute-force detection: 5+ failed logons from same source within 5 minutes -- index=wineventlog EventCode=4625 | stats count by src_ip, Account_Name, _time | where count > 5 | sort -count -- New privileged account created (4720 + 4732 within 60s) -- index=wineventlog (EventCode=4720 OR EventCode=4732) | eval event_type=if(EventCode=4720, "AccountCreated", "AddedToGroup") | transaction Account_Name maxspan=60s | where eventcount=2 AND mvfind(event_type, "AccountCreated") >= 0 | table _time, Account_Name, SubjectUserName, event_type -- Suspicious process creation (cmd.exe / powershell from unusual parent) -- index=wineventlog EventCode=4688 | where Process_Name IN ("*cmd.exe","*powershell.exe","*wscript.exe") | where NOT (Creator_Process_Name IN ("*explorer.exe","*svchost.exe","*csrss.exe")) | table _time, ComputerName, Creator_Process_Name, Process_Name, Process_Command_Line -- New service installation (7045) -- index=wineventlog EventCode=7045 | table _time, ComputerName, Service_Name, Service_File_Name, Service_Account | sort -_time -- Apache: web shell access pattern (POST to .php in upload directory) -- index=apache_logs method=POST uri_path=*/uploads/*.php | stats count by src_ip, uri_path, status | where status=200 | sort -count -- Lateral movement: explicit credential logon (4648) after brute-force -- index=wineventlog EventCode=4648 | join src_ip [search index=wineventlog EventCode=4625 | stats count by src_ip | where count > 5] | table _time, src_ip, Target_Account_Name, Target_Server_Name
Findings
Security Findings
CRITICAL — T1190 — Web Shell Upload via Vulnerable File Upload
Attacker exploited an unrestricted file upload endpoint on the Apache web server to upload a PHP web shell (
img_upload.php). POST request logged in Apache access log at 14:07:22. Subsequent GET requests to the shell with cmd= parameter confirmed remote code execution. Provides initial foothold on the Ubuntu server.
HIGH — T1078 — Valid Account — Privilege Escalation
Event ID 4720 recorded at 14:22:41: new local account
svcbackup created on the Windows endpoint. Event ID 4732 followed 18 seconds later: account added to the local Administrators group. Both events originated from a remote session authenticated as the compromised DOMAIN\webuser service account.
HIGH — T1021.002 — Lateral Movement via SMB
Event ID 4648 logged at 14:19:55 showing an explicit credential logon from the Ubuntu server IP (
192.168.100.20) to the Windows endpoint using a captured service account credential. SMB traffic on port 445 observed between the two hosts. Attacker pivoted from the web shell to the Windows machine using harvested credentials.
MEDIUM — T1543.003 — Malicious Service Installation
Event ID 7045 recorded at 14:31:08: a new service named
WindowsUpdateHelper was installed. Service binary path pointed to C:\Users\svcbackup\AppData\Local\Temp\wupd.exe — a non-standard path for a legitimate Windows Update component. Service configured for automatic start, providing persistence across reboots.
MEDIUM — T1059.001 — Anomalous PowerShell Execution
Event ID 4688 recorded multiple PowerShell invocations with encoded Base64 command strings (
powershell.exe -enc JAB...) spawned as a child of the malicious service binary. Decoded commands revealed a Meterpreter-compatible reverse shell payload attempting outbound connection on port 4444.
Framework Mapping
MITRE ATT&CK Mapping
| Technique ID | Technique Name | Tactic | Evidence Source | Severity |
|---|---|---|---|---|
| T1190 | Exploit Public-Facing Application | Initial Access | Apache access log (POST /uploads/) | Critical |
| T1021.002 | Remote Services: SMB/Windows Admin Shares | Lateral Movement | EventID 4648, 4624 | High |
| T1078 | Valid Accounts (Local Account Abuse) | Privilege Escalation | EventID 4720, 4732 | High |
| T1543.003 | Create or Modify System Process: Windows Service | Persistence | EventID 7045 | Medium |
| T1059.001 | Command & Scripting Interpreter: PowerShell | Execution | EventID 4688 (encoded cmdline) | Medium |
| T1110.001 | Brute Force: Password Guessing | Credential Access | EventID 4625 (volume spike) | Medium |
Documentation
IR Documentation Excerpt
Structured incident response documentation was produced for each finding, following a format consistent with industry standards. The excerpt below shows the template used for each identified technique.
═══════════════════════════════════════════════════════════ INCIDENT REPORT — SOC EXERCISE FINDING #002 ═══════════════════════════════════════════════════════════ Finding Title: Lateral Movement via SMB — Valid Credential Reuse MITRE Technique: T1021.002 — Remote Services: SMB/Windows Admin Shares Tactic: Lateral Movement Severity: HIGH Detection Time: 2024-11-12 14:21:03 UTC Analyst: Sagar Bidari (study project) DESCRIPTION The attacker, having obtained the credential for DOMAIN\webuser via the web shell on the Ubuntu server, used those credentials to authenticate via SMB to the Windows 10 endpoint. EventID 4648 (explicit credential logon) was observed from 192.168.100.20 (Ubuntu web server) targeting 192.168.100.50 (Windows endpoint). EVIDENCE Log Source: Windows Security Event Log — ComputerName: WIN10-ENDPOINT Event IDs: 4648, 4624 (Logon Type 3) Src IP: 192.168.100.20 Account: DOMAIN\webuser Timestamp: 2024-11-12 14:19:55 UTC IOCs 192.168.100.20 (attacker pivot source) DOMAIN\webuser (compromised service account) img_upload.php (web shell filename) RECOMMENDED REMEDIATION 1. Disable DOMAIN\webuser account immediately 2. Rotate all service account credentials in the webuser group 3. Block SMB (TCP 445) inbound at Windows endpoint firewall 4. Patch the file upload vulnerability in the Apache application 5. Conduct password audit for service accounts — apply least privilege ═══════════════════════════════════════════════════════════