DobreTech SIEM

Lab Triage Operations & Objectives

Analyze Incidents: Click on any row within the SIEM dashboard to drop down and inspect internal process fields, logs, network properties, and context comments.
Manage the Queue: Click the pencil icon () on unassigned alerts to pull up the Incident Management modal. Use this to assign an incident to yourself, track status changes, or document custom comments.
Submit Assessment Answers: Scroll down to the Triage Portal. Answer each inquiry completely based on your validation of the logs. Pay strict attention to the structural placeholders provided (e.g. `*@*.*`).
Retrieve Completion Proof: Once all questions successfully show green checkmarks, click the **Reveal Flags** button at the base of the portal to claim your challenge verification text.

Time	Alert Name	Severity	Status	Verdict	Assignee
Mar 27th 2025 at 19:56	Spike of Domain Discovery Commands	Medium	Awaiting action	None	None
DescriptionDetects a spike of commands like whoami, net user, and Get-ADUser, often used during AD domain discovery. Unless the commands are confirmed to be a part of IT activity or legitimate scripts, the device is likely compromised and requires immediate containment. Invoked Commands dir hostname whoami /priv net group "Domain Admins" /domain nltest /dclist:dobretech.com Host NameDMZ-MSEXCHANGE-2013 Host OSWindows Server 2012 R2 UserNT AUTHORITY\SYSTEM Parent ProcessC:\Users\Public\revshell.exe Source ProcessC:\Windows\System32\cmd.exe GrandParent ProcessC:\Windows\System32\inetsrv\w3wp.exe Analyst Comment
Mar 27th 2025 at 19:25	Email Marked as Phishing after Delivery	Medium	Awaiting action	None	None
DescriptionThe email was classified as phishing post-delivery after an automated analysis. If the email is spoofed or contains any suspicious links or files, it must be deeply investigated. SubjectImportant Update: Microsoft Teams Pricing Increase Body Keywords600% price increase; urgent notice; download the report; read the details; SenderMicrosoft Support:support@microsoft.com RecipientEddie Huffman, IT Manager: e.huffman@dobretech.com Security ChecksSPF: FAIL / DKIM: FAIL AttachmentREPORT.rar Analyst Comment
Mar 27th 2025 at 19:10	Web Scanning of Corporate Resources	Low	In Progress	True Positive	E.Fleming (L2)
DescriptionDetects a spike of web requests to the corporate services matching web attack regex. While periodic botnet scans are not a threat, an aggressive scan may indicate a start of a full-scale, targeted attack. Source IP5.178.87.180 Target ResourceDMZ-WEBFRONT-PRD, DMZ-WEBAPI-PRD, DMZ-MSEXCHANGE-2013 Request Count865,700 Unique URIs112569 Request Sample https://www.dobretech.com/products?id=1' OR '1'='1 Analyst Comment Starting at 18:50 UTC and continuing now, the threat actor behind 5[.]178[.]87[.]180 scanned corporate website (www.dobretech.com) and Exchange mail server (mail.dobretech.com) for common web vulnerabilities like XSS and SQLi, and for recent CVE. Given that the web scan reaches 90 thousands requests and looks like a targeted attack, escalating the alert to check for traces of successful exploitation, especially for our unpatched Exchange.
Mar 27th 2025 at 18:30	Sensitive Document Share to External	Medium	In Progress	True Positive	E.Fleming (L2)
DescriptionA Google Drive document stored inside an important folder was shared outside of the organisation to a personal email. This action is a violation of corporate policies and must be reported to the Compliance department. Source User Emailm.boslan@dobretech.com Source User DepartmentHR Department Target User Emailshadow18562@protonmail.thm File NameEmployee Records (Updated). File Typespreadsheet File FolderHR Internal Analyst Comment At 18:30 UTC, m.boslan@dobretech.com (Martin Boslan, HR lead), logged in to their Google Workspace from a trusted LPT-HR-0988 device, and a minute later attempted to download the whole HR folder on their laptop, but was blocked by our DLP solution. A minute later, Martin shared the 'Employee Records (Updated)' spreadsheet to an unidentified shadow18562@protonmail.thm Protonmail email. Although no events are followed, escalating the alert to communicate with Martin and report the incident to the Compliance team.
Mar 27th 2025 at 18:02	Fast Beaconing to Untrusted Domain	High	Closed	False Positive	S.Todd (L1)
DescriptionThe rule detects repeated connections to a single domain with a static period like every 30 or 60 seconds. The connections may indicate a presence of C2 on the system, beaconing to the malicious destination. Destinationconnectivity-check.ubuntu.com:443 Source Hostprd-nginx-gc8610 Source Process/usr/bin/NetworkManager Analyst Comment The Nginx web server prd-nginx-gc8610 uses Ubuntu 20.04 as its OS, and periodic connections to the official connectivity check domain coming from a trusted /usr/bin/NetworkManager are expected for the system.

Triage Assessment Portal

Complete your review using the dashboard entries above. Follow the specified placeholder formats exactly.

0 / 0 solved

DobreTech SIEM

Lab Triage Operations & Objectives

Triage Assessment Portal

Edit Alert