================================================================================ INCIDENT ALERT TIMELINE — OPERATION SHADOW HARVEST Date: 2026-04-09 | Window: 01:00 UTC – 05:00 UTC Incident ID: IR-2026-0409-007 ================================================================================ ALERT #01 Timestamp : 2026-04-09T01:03:22Z Source : IDS (Suricata) Severity : LOW Alert ID : IDS-44871 Description: Inbound SSH brute-force attempt detected from 185.220.101.34 targeting 10.10.4.20 (jump-box). 47 failed login attempts in 90 seconds. Signature: ET SCAN SSH BruteForce. ALERT #02 Timestamp : 2026-04-09T01:07:48Z Source : Firewall (Palo Alto) Severity : MEDIUM Alert ID : FW-90123 Description: Firewall blocked outbound connection from 10.10.4.20 to 185.220.101.34:4443. Rule: deny-unknown-outbound. Connection type TCP, 3 attempts in 12 seconds. ALERT #03 Timestamp : 2026-04-09T01:12:05Z Source : Authentication (Active Directory) Severity : MEDIUM Alert ID : AUTH-7721 Description: Successful login for service account 'svc-backup' from unexpected source 10.10.4.20. Account normally authenticates only from 10.10.1.5 (backup server). Time-of-day anomaly: account has never authenticated between 00:00–06:00 UTC. ALERT #04 Timestamp : 2026-04-09T01:14:33Z Source : IDS (Suricata) Severity : HIGH Alert ID : IDS-44879 Description: Exploit signature matched — possible CVE-2024-21887 exploitation attempt. Source: 10.10.4.20 → 10.10.2.10 (vpn-gateway). Payload contains encoded command injection string. ALERT #05 Timestamp : 2026-04-09T01:18:50Z Source : EDR (CrowdStrike Falcon) Severity : HIGH Alert ID : EDR-33210 Description: Suspicious process execution on WEB-SVR-01 (10.10.2.50). Process: powershell.exe -enc Parent: w3wp.exe (IIS worker process). Tactic: Execution (T1059.001). No prior history of encoded PowerShell from this host. ALERT #06 Timestamp : 2026-04-09T01:22:17Z Source : EDR (CrowdStrike Falcon) Severity : HIGH Alert ID : EDR-33214 Description: Credential dumping detected on WEB-SVR-01 (10.10.2.50). Tool signature matches Mimikatz (sekurlsa::logonpasswords). Process chain: w3wp.exe → powershell.exe → mimikatz.exe. Tactic: Credential Access (T1003.001). ALERT #07 Timestamp : 2026-04-09T01:31:44Z Source : Authentication (Active Directory) Severity : HIGH Alert ID : AUTH-7729 Description: Kerberos ticket-granting ticket (TGT) requested for domain admin account 'da-jthompson' from 10.10.2.50 (WEB-SVR-01). This account has never authenticated from a web server. Possible Pass-the-Hash / credential reuse. ALERT #08 Timestamp : 2026-04-09T01:35:02Z Source : Firewall (Palo Alto) Severity : MEDIUM Alert ID : FW-90131 Description: Internal lateral movement detected. 10.10.2.50 initiated SMB connections to 10.10.3.15, 10.10.3.16, 10.10.3.17 in rapid succession (< 5 seconds). Rule: detect-internal-scan. ALERT #09 Timestamp : 2026-04-09T01:38:19Z Source : IDS (Suricata) Severity : MEDIUM Alert ID : IDS-44892 Description: PsExec-style remote service creation detected. Source: 10.10.2.50 → 10.10.3.15 (DB-PRIMARY). Service name: "WindowsUpdateSvc". Binary path points to C:\Windows\Temp\svc_update.exe. Tactic: Lateral Movement (T1021.002). ALERT #10 Timestamp : 2026-04-09T01:44:55Z Source : EDR (CrowdStrike Falcon) Severity : CRITICAL Alert ID : EDR-33221 Description: Malware detected on DB-PRIMARY (10.10.3.15). File: C:\Windows\Temp\svc_update.exe SHA256: a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2 Classification: Backdoor.Cobalt.Beacon. C2 callback to 91.215.85.142:443 detected. ALERT #11 Timestamp : 2026-04-09T02:01:30Z Source : Authentication (Active Directory) Severity : HIGH Alert ID : AUTH-7735 Description: Multiple failed login attempts for 'da-jthompson' on domain controller DC-01 (10.10.1.2) from 10.10.3.15. 5 failures followed by successful authentication. Possible password spray pivot from compromised database server. ALERT #12 Timestamp : 2026-04-09T02:08:47Z Source : EDR (CrowdStrike Falcon) Severity : CRITICAL Alert ID : EDR-33228 Description: Scheduled task created on DC-01 (10.10.1.2). Task name: "SystemHealthCheck" Action: cmd.exe /c C:\ProgramData\healthchk.exe Created by: da-jthompson from 10.10.3.15. Tactic: Persistence (T1053.005). ALERT #13 Timestamp : 2026-04-09T02:15:33Z Source : IDS (Suricata) Severity : HIGH Alert ID : IDS-44901 Description: DNS tunneling signature detected. DC-01 (10.10.1.2) sending high-frequency TXT queries to c2-relay.darkcloud-services.net. Average query length: 187 characters. 340 queries in 5 minutes. Signature: ET MALWARE DNS Tunneling. ALERT #14 Timestamp : 2026-04-09T02:29:08Z Source : Firewall (Palo Alto) Severity : HIGH Alert ID : FW-90148 Description: Outbound HTTPS connection from DC-01 (10.10.1.2) to 91.215.85.142:443. Connection duration: 14 minutes (ongoing). Data transferred: 847 MB outbound. Rule: alert-high-volume-egress. ALERT #15 Timestamp : 2026-04-09T02:42:11Z Source : DLP (Symantec DLP) Severity : CRITICAL Alert ID : DLP-5501 Description: Sensitive data pattern match on outbound traffic from DC-01. Pattern: Social Security Number (bulk). Estimated records: 12,000+. Destination: 91.215.85.142. Channel: HTTPS (encrypted). Policy: PII-Exfiltration-Block (alert-only mode). ALERT #16 Timestamp : 2026-04-09T02:55:40Z Source : DLP (Symantec DLP) Severity : CRITICAL Alert ID : DLP-5504 Description: Database export file detected in outbound traffic from 10.10.3.15 (DB-PRIMARY). File pattern matches SQL dump format. Estimated size: 2.3 GB. Destination: 198.51.100.77:8443. Channel: HTTPS. New C2 endpoint not previously observed. ALERT #17 Timestamp : 2026-04-09T03:10:22Z Source : EDR (CrowdStrike Falcon) Severity : HIGH Alert ID : EDR-33240 Description: Anti-forensics activity detected on WEB-SVR-01 (10.10.2.50). Windows event logs cleared (Security, System, Application). Process: wevtutil.exe cl Security. Executed by: da-jthompson. Tactic: Defense Evasion (T1070.001). ALERT #18 Timestamp : 2026-04-09T03:28:55Z Source : IDS (Suricata) Severity : MEDIUM Alert ID : IDS-44918 Description: Outbound connection to known Tor exit node 104.244.76.13 from WKSTN-FIN-03 (10.10.5.30). Port 9001. No prior Tor activity from this network segment. ALERT #19 Timestamp : 2026-04-09T04:05:13Z Source : Authentication (Active Directory) Severity : HIGH Alert ID : AUTH-7752 Description: New domain admin account 'svc-healthmon' created by 'da-jthompson' from DC-01. Account immediately added to "Domain Admins" and "Enterprise Admins" groups. No change request ticket found. Tactic: Persistence (T1136.002). ALERT #20 Timestamp : 2026-04-09T04:47:30Z Source : EDR (CrowdStrike Falcon) Severity : CRITICAL Alert ID : EDR-33255 Description: Ransomware pre-staging detected on FILE-SVR-01 (10.10.3.20). File enumeration of network shares (\\FILE-SVR-01\finance$, \\FILE-SVR-01\hr-docs$, \\FILE-SVR-01\legal$) by process svc_update.exe running as svc-healthmon. 45,000 files catalogued in 8 minutes. No encryption started yet. Tactic: Impact (T1486 — pre-stage). ================================================================================ END OF ALERT TIMELINE Total Alerts: 20 | Critical: 5 | High: 8 | Medium: 5 | Low: 2 Attack Narrative: Initial access via SSH brute-force → credential theft → lateral movement to DB and DC → data exfiltration (PII + DB dumps) → persistence establishment → ransomware staging (not yet detonated). ================================================================================