=============================================================================== SOC ALERT FEED — GLOBEX CORPORATION Time Window: 2026-03-15 06:00 UTC to 2026-03-15 12:00 UTC Source: Splunk SIEM / Suricata / CrowdStrike EDR / Exchange Gateway =============================================================================== NOTE: All timestamps are UTC. Severity: CRIT / HIGH / MED / LOW / INFO. # TIMESTAMP SOURCE SEVERITY ALERT TITLE --- -------------------- ------------- -------- ----------------------------------------------- 001 2026-03-15 06:02:14 ExchGateway MED Inbound phishing email detected — sender: recruiter@talentlink-global[.]com, subject: "Your Interview Confirmation — Action Required", recipient: m.chen@globex.com, attachment: Interview_Details.html 002 2026-03-15 06:02:14 ExchGateway LOW Spam quarantine — sender: deals@cheapmeds99[.]ru, recipient: all-staff@globex.com (auto-quarantined) 003 2026-03-15 06:05:31 ExchGateway INFO DLP scan clean — outbound email from j.martinez@globex.com to vendor, no sensitive content detected 004 2026-03-15 06:12:47 ProxyLog MED User m.chen@globex.com clicked URL in email — GET https://talentlink-global[.]com/portal/confirm.php from WKS-MCHEN (10.20.30.45) 005 2026-03-15 06:12:49 Suricata HIGH ET TROJAN Observed Malicious Redirect — talentlink-global[.]com/portal/confirm.php redirected to credential-harvesting page at login-microsoftonline[.]xyz 006 2026-03-15 06:13:02 ProxyLog MED POST request from WKS-MCHEN to login-microsoftonline[.]xyz/auth — possible credential submission 007 2026-03-15 06:13:55 AzureAD HIGH Impossible travel alert — m.chen@globex.com authenticated from 10.20.30.45 (HQ) and 185.220.101[.]34 (Tor exit node) within 60 seconds 008 2026-03-15 06:15:00 CrowdStrike LOW Scheduled scan completed on SRV-FILE01 — no threats detected (routine, daily) 009 2026-03-15 06:18:33 CrowdStrike HIGH Suspicious process on WKS-MCHEN — powershell.exe launched with encoded command, parent: outlook.exe, user: m.chen 010 2026-03-15 06:18:34 Sysmon HIGH Process Create (Event ID 1) — powershell.exe -EncodedCommand SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBj... on WKS-MCHEN, parent PID 4812 (OUTLOOK.EXE) 011 2026-03-15 06:19:01 CrowdStrike MED WKS-MCHEN — powershell.exe downloading file from https://cdn-static-assets[.]net/update.bin (known staging domain) 012 2026-03-15 06:19:45 Suricata HIGH ET MALWARE CobaltStrike Beacon Checkin — WKS-MCHEN (10.20.30.45) -> 198.51.100[.]22:443, JA3: a0e9f5d64349fb13191bc781f81f42e1 013 2026-03-15 06:20:00 Firewall INFO Allowed HTTPS 10.20.30.45 -> 198.51.100[.]22:443 (category: uncategorized) 014 2026-03-15 06:22:17 WindowsEvt LOW Event ID 4624 — Logon Type 10 (RDP) — m.chen logged onto WKS-MCHEN from console (normal morning login pattern) 015 2026-03-15 06:25:10 CrowdStrike LOW Chrome update service (GoogleUpdate.exe) ran on 15 workstations — benign, matches software deployment schedule 016 2026-03-15 06:31:44 Suricata HIGH ET SCAN Internal Port Scan Detected — source 10.20.30.45 scanning 10.20.30.0/24 on ports 445,3389,22,80,8080 — 147 connection attempts in 30 seconds 017 2026-03-15 06:31:45 Firewall MED Multiple denied connections from 10.20.30.45 to 10.20.40.0/24 (database VLAN) — ACL block, 53 attempts 018 2026-03-15 06:33:02 Sysmon HIGH Process Create — WKS-MCHEN: nltest.exe /dclist:globex.local, user: m.chen — Active Directory enumeration 019 2026-03-15 06:33:18 Sysmon HIGH Process Create — WKS-MCHEN: net.exe group "Domain Admins" /domain, user: m.chen — privilege group enumeration 020 2026-03-15 06:34:00 WindowsEvt LOW Event ID 4625 — Failed logon for m.chen on SRV-DC01 — Logon Type 3 (network), status: wrong password 021 2026-03-15 06:35:22 Suricata LOW DNS query for windowsupdate.microsoft.com from SRV-WEB01 — benign, OS update check 022 2026-03-15 06:38:50 WindowsEvt MED Event ID 4625 — 5 failed RDP logons from 10.20.30.45 to SRV-FILE01 (10.20.30.10) — accounts tried: administrator, admin, m.chen, svc_backup, j.martinez 023 2026-03-15 06:40:12 CrowdStrike HIGH Credential dumping detected on WKS-MCHEN — comsvcs.dll used to dump lsass.exe memory, PID 812 targeting PID 648 (lsass), user: m.chen 024 2026-03-15 06:41:30 Sysmon HIGH Process Create — WKS-MCHEN: rundll32.exe C:\Windows\System32\comsvcs.dll MiniDump 648 C:\Temp\debug.dmp full — LSASS memory dump 025 2026-03-15 06:43:00 PrintSpooler LOW Print job completed — user d.wilson, printer: 3F-HP-Color, 12 pages (routine) 026 2026-03-15 06:47:15 WindowsEvt HIGH Event ID 4624 — Logon Type 3 (Network) — user svc_backup successfully authenticated to SRV-FILE01 (10.20.30.10) from WKS-MCHEN (10.20.30.45) — service account compromise 027 2026-03-15 06:47:16 WindowsEvt MED Event ID 4672 — Special privileges (SeBackupPrivilege, SeRestorePrivilege) assigned to svc_backup on SRV-FILE01 028 2026-03-15 06:50:33 CrowdStrike MED WKS-JPARK — Microsoft Defender real-time protection disabled via registry modification — user: j.park (help desk ticket #4521 — user disabled for software install troubleshooting, likely benign) 029 2026-03-15 06:55:00 Suricata HIGH ET EXPLOIT EternalBlue Attempt — 10.20.30.45 -> 10.20.30.15 (SRV-PRINT01) on TCP/445 — MS17-010 exploitation attempt 030 2026-03-15 06:55:03 WindowsEvt CRIT Event ID 4624 — Logon Type 3 — SYSTEM account active on SRV-PRINT01 from 10.20.30.45 — successful exploitation via vulnerable SMBv1 service 031 2026-03-15 06:56:22 CrowdStrike CRIT Lateral movement confirmed — new CobaltStrike beacon on SRV-PRINT01 (10.20.30.15), callback to 198.51.100[.]22:443, user: SYSTEM 032 2026-03-15 06:58:00 Firewall INFO Allowed DNS 10.20.30.15 -> 10.20.30.2 (internal DNS) — lookup for srv-dc01.globex.local (could be recon or normal) 033 2026-03-15 07:02:44 Sysmon HIGH Process Create — SRV-PRINT01: net.exe localgroup administrators, user: SYSTEM — local admin group enumeration 034 2026-03-15 07:05:18 WindowsEvt HIGH Event ID 4728 — User svc_backup added to Domain Admins group on SRV-DC01 — changed by: SYSTEM (from SRV-PRINT01) 035 2026-03-15 07:05:19 WindowsEvt CRIT Event ID 4672 — Special privileges (all) assigned to svc_backup — account now has Domain Admin rights 036 2026-03-15 07:10:00 Suricata LOW DNS TXT query from WKS-LRODRIGUEZ for _dmarc.globex.com — benign, email validation 037 2026-03-15 07:15:30 CrowdStrike HIGH Data staging detected — SRV-FILE01: 7z.exe compressing \\SRV-FILE01\Finance\Q1-Reports\*.xlsx and \\SRV-FILE01\HR\Compensation\*.csv to C:\Temp\archive.7z, user: svc_backup — 847 MB total 038 2026-03-15 07:15:31 Sysmon MED File Create — SRV-FILE01: C:\Temp\archive.7z — size: 214 MB (compressed from 847 MB) 039 2026-03-15 07:18:00 WindowsEvt LOW Event ID 4634 — Logoff for t.nguyen from WKS-TNGUYEN — end of overnight shift (routine) 040 2026-03-15 07:22:45 Suricata CRIT ET EXFIL Large Outbound Transfer — SRV-FILE01 (10.20.30.10) -> 203.0.113[.]77:443 — 214 MB HTTPS upload over 4 minutes — destination: cloud storage endpoint (mega[.]nz) 041 2026-03-15 07:22:46 Firewall HIGH Unusual outbound traffic — SRV-FILE01 -> 203.0.113[.]77:443 — server has no business reason for outbound HTTPS to external cloud storage 042 2026-03-15 07:23:00 DLP CRIT Data loss prevention alert — 214 MB exfiltration detected from SRV-FILE01 to external IP 203.0.113[.]77 — file type: 7z archive — classification: CONFIDENTIAL content detected (Finance, HR data) 043 2026-03-15 07:25:00 CrowdStrike LOW Scheduled task created on SRV-BACKUP01 — task: "WindowsHealthCheck", runs daily at 03:00 — legitimate IT automation (matches change ticket #CT-2026-0312) 044 2026-03-15 07:30:15 Suricata MED DNS query from SRV-PRINT01 for ns1.c2-relay-node[.]net — known C2 infrastructure domain (threat intel match) 045 2026-03-15 07:35:00 CrowdStrike HIGH Persistence mechanism detected — SRV-PRINT01: registry Run key added: HKLM\Software\Microsoft\Windows\CurrentVersion\Run\PrintMon = "C:\Windows\Temp\svcmon.exe" — unsigned binary 046 2026-03-15 07:40:00 AzureAD MED Password reset for m.chen initiated from IP 185.220.101[.]34 (Tor exit node) — MFA challenge sent but not completed 047 2026-03-15 07:42:00 ExchGateway LOW Outbound email from a.kumar@globex.com to personal Gmail — no sensitive content (DLP clean) 048 2026-03-15 07:55:22 Suricata LOW ET INFO TLS Handshake from SRV-WEB01 to cdn.jsdelivr.net — benign CDN traffic for hosted web application 049 2026-03-15 08:10:00 CrowdStrike MED WKS-MCHEN — additional reconnaissance: systeminfo.exe, ipconfig /all, tasklist /v executed in rapid succession — attacker profiling host 050 2026-03-15 08:30:00 WindowsEvt LOW Event ID 4648 — Explicit credential logon: j.martinez on WKS-JMARTINEZ using RunAs — matches IT troubleshooting ticket (routine) 051 2026-03-15 08:45:12 Suricata HIGH ET MALWARE CobaltStrike DNS Beacon — SRV-PRINT01 sending encoded DNS TXT queries to c2-relay-node[.]net at regular 60-second intervals 052 2026-03-15 09:00:00 Firewall LOW Denied inbound SSH from 45.33.32.156 to DMZ-WEB01 — brute force attempt, 23 attempts in 5 min, IP blacklisted (automated, external scanner) 053 2026-03-15 09:15:00 CrowdStrike LOW Software inventory scan ran on all endpoints — scheduled weekly task, no anomalies (routine) 054 2026-03-15 09:30:44 Sysmon HIGH Process Create — SRV-FILE01: vssadmin.exe delete shadows /all /quiet — shadow copy deletion, user: svc_backup — possible ransomware preparation or anti-forensics 055 2026-03-15 09:35:00 WindowsEvt MED Event ID 1102 — Security event log cleared on SRV-PRINT01 — anti-forensics activity 056 2026-03-15 09:40:00 Suricata LOW ET POLICY Outbound SSH from DMZ-WEB01 to GitHub (benign — automated deployment pull) 057 2026-03-15 10:00:00 CrowdStrike INFO Daily threat intelligence feed update completed — 342 new IOCs ingested 058 2026-03-15 10:15:33 WindowsEvt HIGH Event ID 4720 — New user account created: "support_admin" on SRV-DC01 by svc_backup — backdoor account 059 2026-03-15 10:15:34 WindowsEvt HIGH Event ID 4728 — User support_admin added to Domain Admins group on SRV-DC01 060 2026-03-15 10:30:00 Firewall LOW Allowed HTTPS from WKS-DKIM to outlook.office365.com — routine email sync 061 2026-03-15 10:45:00 Suricata MED ET SCAN Nmap SYN Scan Detected — external IP 198.51.100[.]99 scanning DMZ range 10.10.10.0/24 — 500+ ports — likely automated internet scanner (not related to internal incident) 062 2026-03-15 11:00:00 CrowdStrike LOW Endpoint agent updated on 47 workstations — version 7.14.16703 (routine patch Tuesday push) 063 2026-03-15 11:15:22 Sysmon HIGH File Create — SRV-DC01: C:\Windows\Temp\ntds_dump.dit — NTDS.dit database copied, user: svc_backup — full domain credential extraction 064 2026-03-15 11:30:00 WindowsEvt LOW Event ID 4624 — Logon Type 2 (Interactive) — r.patel logged into WKS-RPATEL — normal morning login 065 2026-03-15 11:45:00 Suricata CRIT ET EXFIL DNS Tunneling Detected — SRV-DC01 sending abnormally large DNS TXT responses to ns1.c2-relay-node[.]net — encoded data in queries averaging 230 bytes each, 400+ queries in 15 min =============================================================================== END OF ALERT FEED Total alerts: 65 Severity breakdown: CRIT=5, HIGH=18, MED=13, LOW=19, INFO=5 Recommended immediate actions: Triage CRIT and HIGH alerts first. Student task: Classify each alert as TRUE POSITIVE, FALSE POSITIVE, or BENIGN/EXPECTED. Reconstruct the full attack timeline. Identify the kill chain stages and map to MITRE ATT&CK techniques. ===============================================================================