================================================================================
  INCIDENT ALERT TIMELINE — OPERATION SHADOW HARVEST
  Date: 2026-04-09  |  Window: 01:00 UTC – 05:00 UTC
  Incident ID: IR-2026-0409-007
================================================================================

ALERT #01
  Timestamp : 2026-04-09T01:03:22Z
  Source    : IDS (Suricata)
  Severity  : LOW
  Alert ID  : IDS-44871
  Description: Inbound SSH brute-force attempt detected from 185.220.101.34
               targeting 10.10.4.20 (jump-box). 47 failed login attempts in
               90 seconds. Signature: ET SCAN SSH BruteForce.

ALERT #02
  Timestamp : 2026-04-09T01:07:48Z
  Source    : Firewall (Palo Alto)
  Severity  : MEDIUM
  Alert ID  : FW-90123
  Description: Firewall blocked outbound connection from 10.10.4.20 to
               185.220.101.34:4443. Rule: deny-unknown-outbound. Connection
               type TCP, 3 attempts in 12 seconds.

ALERT #03
  Timestamp : 2026-04-09T01:12:05Z
  Source    : Authentication (Active Directory)
  Severity  : MEDIUM
  Alert ID  : AUTH-7721
  Description: Successful login for service account 'svc-backup' from
               unexpected source 10.10.4.20. Account normally authenticates
               only from 10.10.1.5 (backup server). Time-of-day anomaly:
               account has never authenticated between 00:00–06:00 UTC.

ALERT #04
  Timestamp : 2026-04-09T01:14:33Z
  Source    : IDS (Suricata)
  Severity  : HIGH
  Alert ID  : IDS-44879
  Description: Exploit signature matched — possible CVE-2024-21887 exploitation
               attempt. Source: 10.10.4.20 → 10.10.2.10 (vpn-gateway).
               Payload contains encoded command injection string.

ALERT #05
  Timestamp : 2026-04-09T01:18:50Z
  Source    : EDR (CrowdStrike Falcon)
  Severity  : HIGH
  Alert ID  : EDR-33210
  Description: Suspicious process execution on WEB-SVR-01 (10.10.2.50).
               Process: powershell.exe -enc <base64_blob>
               Parent: w3wp.exe (IIS worker process).
               Tactic: Execution (T1059.001). No prior history of encoded
               PowerShell from this host.

ALERT #06
  Timestamp : 2026-04-09T01:22:17Z
  Source    : EDR (CrowdStrike Falcon)
  Severity  : HIGH
  Alert ID  : EDR-33214
  Description: Credential dumping detected on WEB-SVR-01 (10.10.2.50).
               Tool signature matches Mimikatz (sekurlsa::logonpasswords).
               Process chain: w3wp.exe → powershell.exe → mimikatz.exe.
               Tactic: Credential Access (T1003.001).

ALERT #07
  Timestamp : 2026-04-09T01:31:44Z
  Source    : Authentication (Active Directory)
  Severity  : HIGH
  Alert ID  : AUTH-7729
  Description: Kerberos ticket-granting ticket (TGT) requested for domain
               admin account 'da-jthompson' from 10.10.2.50 (WEB-SVR-01).
               This account has never authenticated from a web server.
               Possible Pass-the-Hash / credential reuse.

ALERT #08
  Timestamp : 2026-04-09T01:35:02Z
  Source    : Firewall (Palo Alto)
  Severity  : MEDIUM
  Alert ID  : FW-90131
  Description: Internal lateral movement detected. 10.10.2.50 initiated SMB
               connections to 10.10.3.15, 10.10.3.16, 10.10.3.17 in rapid
               succession (< 5 seconds). Rule: detect-internal-scan.

ALERT #09
  Timestamp : 2026-04-09T01:38:19Z
  Source    : IDS (Suricata)
  Severity  : MEDIUM
  Alert ID  : IDS-44892
  Description: PsExec-style remote service creation detected.
               Source: 10.10.2.50 → 10.10.3.15 (DB-PRIMARY).
               Service name: "WindowsUpdateSvc". Binary path points to
               C:\Windows\Temp\svc_update.exe. Tactic: Lateral Movement (T1021.002).

ALERT #10
  Timestamp : 2026-04-09T01:44:55Z
  Source    : EDR (CrowdStrike Falcon)
  Severity  : CRITICAL
  Alert ID  : EDR-33221
  Description: Malware detected on DB-PRIMARY (10.10.3.15).
               File: C:\Windows\Temp\svc_update.exe
               SHA256: a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2
               Classification: Backdoor.Cobalt.Beacon.
               C2 callback to 91.215.85.142:443 detected.

ALERT #11
  Timestamp : 2026-04-09T02:01:30Z
  Source    : Authentication (Active Directory)
  Severity  : HIGH
  Alert ID  : AUTH-7735
  Description: Multiple failed login attempts for 'da-jthompson' on domain
               controller DC-01 (10.10.1.2) from 10.10.3.15. 5 failures
               followed by successful authentication. Possible password spray
               pivot from compromised database server.

ALERT #12
  Timestamp : 2026-04-09T02:08:47Z
  Source    : EDR (CrowdStrike Falcon)
  Severity  : CRITICAL
  Alert ID  : EDR-33228
  Description: Scheduled task created on DC-01 (10.10.1.2).
               Task name: "SystemHealthCheck"
               Action: cmd.exe /c C:\ProgramData\healthchk.exe
               Created by: da-jthompson from 10.10.3.15.
               Tactic: Persistence (T1053.005).

ALERT #13
  Timestamp : 2026-04-09T02:15:33Z
  Source    : IDS (Suricata)
  Severity  : HIGH
  Alert ID  : IDS-44901
  Description: DNS tunneling signature detected. DC-01 (10.10.1.2) sending
               high-frequency TXT queries to c2-relay.darkcloud-services.net.
               Average query length: 187 characters. 340 queries in 5 minutes.
               Signature: ET MALWARE DNS Tunneling.

ALERT #14
  Timestamp : 2026-04-09T02:29:08Z
  Source    : Firewall (Palo Alto)
  Severity  : HIGH
  Alert ID  : FW-90148
  Description: Outbound HTTPS connection from DC-01 (10.10.1.2) to
               91.215.85.142:443. Connection duration: 14 minutes (ongoing).
               Data transferred: 847 MB outbound. Rule: alert-high-volume-egress.

ALERT #15
  Timestamp : 2026-04-09T02:42:11Z
  Source    : DLP (Symantec DLP)
  Severity  : CRITICAL
  Alert ID  : DLP-5501
  Description: Sensitive data pattern match on outbound traffic from DC-01.
               Pattern: Social Security Number (bulk). Estimated records: 12,000+.
               Destination: 91.215.85.142. Channel: HTTPS (encrypted).
               Policy: PII-Exfiltration-Block (alert-only mode).

ALERT #16
  Timestamp : 2026-04-09T02:55:40Z
  Source    : DLP (Symantec DLP)
  Severity  : CRITICAL
  Alert ID  : DLP-5504
  Description: Database export file detected in outbound traffic from
               10.10.3.15 (DB-PRIMARY). File pattern matches SQL dump format.
               Estimated size: 2.3 GB. Destination: 198.51.100.77:8443.
               Channel: HTTPS. New C2 endpoint not previously observed.

ALERT #17
  Timestamp : 2026-04-09T03:10:22Z
  Source    : EDR (CrowdStrike Falcon)
  Severity  : HIGH
  Alert ID  : EDR-33240
  Description: Anti-forensics activity detected on WEB-SVR-01 (10.10.2.50).
               Windows event logs cleared (Security, System, Application).
               Process: wevtutil.exe cl Security. Executed by: da-jthompson.
               Tactic: Defense Evasion (T1070.001).

ALERT #18
  Timestamp : 2026-04-09T03:28:55Z
  Source    : IDS (Suricata)
  Severity  : MEDIUM
  Alert ID  : IDS-44918
  Description: Outbound connection to known Tor exit node 104.244.76.13
               from WKSTN-FIN-03 (10.10.5.30). Port 9001.
               No prior Tor activity from this network segment.

ALERT #19
  Timestamp : 2026-04-09T04:05:13Z
  Source    : Authentication (Active Directory)
  Severity  : HIGH
  Alert ID  : AUTH-7752
  Description: New domain admin account 'svc-healthmon' created by
               'da-jthompson' from DC-01. Account immediately added to
               "Domain Admins" and "Enterprise Admins" groups.
               No change request ticket found. Tactic: Persistence (T1136.002).

ALERT #20
  Timestamp : 2026-04-09T04:47:30Z
  Source    : EDR (CrowdStrike Falcon)
  Severity  : CRITICAL
  Alert ID  : EDR-33255
  Description: Ransomware pre-staging detected on FILE-SVR-01 (10.10.3.20).
               File enumeration of network shares (\\FILE-SVR-01\finance$,
               \\FILE-SVR-01\hr-docs$, \\FILE-SVR-01\legal$) by process
               svc_update.exe running as svc-healthmon. 45,000 files
               catalogued in 8 minutes. No encryption started yet.
               Tactic: Impact (T1486 — pre-stage).

================================================================================
  END OF ALERT TIMELINE
  Total Alerts: 20  |  Critical: 5  |  High: 8  |  Medium: 5  |  Low: 2
  Attack Narrative: Initial access via SSH brute-force → credential theft →
    lateral movement to DB and DC → data exfiltration (PII + DB dumps) →
    persistence establishment → ransomware staging (not yet detonated).
================================================================================
