===============================================================================
  SOC ALERT FEED — GLOBEX CORPORATION
  Time Window: 2026-03-15 06:00 UTC  to  2026-03-15 12:00 UTC
  Source: Splunk SIEM / Suricata / CrowdStrike EDR / Exchange Gateway
===============================================================================

NOTE: All timestamps are UTC. Severity: CRIT / HIGH / MED / LOW / INFO.

#   TIMESTAMP             SOURCE        SEVERITY  ALERT TITLE
--- --------------------  ------------- --------  -----------------------------------------------
001 2026-03-15 06:02:14   ExchGateway   MED       Inbound phishing email detected — sender: recruiter@talentlink-global[.]com, subject: "Your Interview Confirmation — Action Required", recipient: m.chen@globex.com, attachment: Interview_Details.html
002 2026-03-15 06:02:14   ExchGateway   LOW       Spam quarantine — sender: deals@cheapmeds99[.]ru, recipient: all-staff@globex.com (auto-quarantined)
003 2026-03-15 06:05:31   ExchGateway   INFO      DLP scan clean — outbound email from j.martinez@globex.com to vendor, no sensitive content detected
004 2026-03-15 06:12:47   ProxyLog      MED       User m.chen@globex.com clicked URL in email — GET https://talentlink-global[.]com/portal/confirm.php from WKS-MCHEN (10.20.30.45)
005 2026-03-15 06:12:49   Suricata      HIGH      ET TROJAN Observed Malicious Redirect — talentlink-global[.]com/portal/confirm.php redirected to credential-harvesting page at login-microsoftonline[.]xyz
006 2026-03-15 06:13:02   ProxyLog      MED       POST request from WKS-MCHEN to login-microsoftonline[.]xyz/auth — possible credential submission
007 2026-03-15 06:13:55   AzureAD       HIGH      Impossible travel alert — m.chen@globex.com authenticated from 10.20.30.45 (HQ) and 185.220.101[.]34 (Tor exit node) within 60 seconds
008 2026-03-15 06:15:00   CrowdStrike   LOW       Scheduled scan completed on SRV-FILE01 — no threats detected (routine, daily)
009 2026-03-15 06:18:33   CrowdStrike   HIGH      Suspicious process on WKS-MCHEN — powershell.exe launched with encoded command, parent: outlook.exe, user: m.chen
010 2026-03-15 06:18:34   Sysmon        HIGH      Process Create (Event ID 1) — powershell.exe -EncodedCommand SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBj... on WKS-MCHEN, parent PID 4812 (OUTLOOK.EXE)
011 2026-03-15 06:19:01   CrowdStrike   MED       WKS-MCHEN — powershell.exe downloading file from https://cdn-static-assets[.]net/update.bin (known staging domain)
012 2026-03-15 06:19:45   Suricata      HIGH      ET MALWARE CobaltStrike Beacon Checkin — WKS-MCHEN (10.20.30.45) -> 198.51.100[.]22:443, JA3: a0e9f5d64349fb13191bc781f81f42e1
013 2026-03-15 06:20:00   Firewall      INFO      Allowed HTTPS 10.20.30.45 -> 198.51.100[.]22:443 (category: uncategorized)
014 2026-03-15 06:22:17   WindowsEvt    LOW       Event ID 4624 — Logon Type 10 (RDP) — m.chen logged onto WKS-MCHEN from console (normal morning login pattern)
015 2026-03-15 06:25:10   CrowdStrike   LOW       Chrome update service (GoogleUpdate.exe) ran on 15 workstations — benign, matches software deployment schedule
016 2026-03-15 06:31:44   Suricata      HIGH      ET SCAN Internal Port Scan Detected — source 10.20.30.45 scanning 10.20.30.0/24 on ports 445,3389,22,80,8080 — 147 connection attempts in 30 seconds
017 2026-03-15 06:31:45   Firewall      MED       Multiple denied connections from 10.20.30.45 to 10.20.40.0/24 (database VLAN) — ACL block, 53 attempts
018 2026-03-15 06:33:02   Sysmon        HIGH      Process Create — WKS-MCHEN: nltest.exe /dclist:globex.local, user: m.chen — Active Directory enumeration
019 2026-03-15 06:33:18   Sysmon        HIGH      Process Create — WKS-MCHEN: net.exe group "Domain Admins" /domain, user: m.chen — privilege group enumeration
020 2026-03-15 06:34:00   WindowsEvt    LOW       Event ID 4625 — Failed logon for m.chen on SRV-DC01 — Logon Type 3 (network), status: wrong password
021 2026-03-15 06:35:22   Suricata      LOW       DNS query for windowsupdate.microsoft.com from SRV-WEB01 — benign, OS update check
022 2026-03-15 06:38:50   WindowsEvt    MED       Event ID 4625 — 5 failed RDP logons from 10.20.30.45 to SRV-FILE01 (10.20.30.10) — accounts tried: administrator, admin, m.chen, svc_backup, j.martinez
023 2026-03-15 06:40:12   CrowdStrike   HIGH      Credential dumping detected on WKS-MCHEN — comsvcs.dll used to dump lsass.exe memory, PID 812 targeting PID 648 (lsass), user: m.chen
024 2026-03-15 06:41:30   Sysmon        HIGH      Process Create — WKS-MCHEN: rundll32.exe C:\Windows\System32\comsvcs.dll MiniDump 648 C:\Temp\debug.dmp full — LSASS memory dump
025 2026-03-15 06:43:00   PrintSpooler  LOW       Print job completed — user d.wilson, printer: 3F-HP-Color, 12 pages (routine)
026 2026-03-15 06:47:15   WindowsEvt    HIGH      Event ID 4624 — Logon Type 3 (Network) — user svc_backup successfully authenticated to SRV-FILE01 (10.20.30.10) from WKS-MCHEN (10.20.30.45) — service account compromise
027 2026-03-15 06:47:16   WindowsEvt    MED       Event ID 4672 — Special privileges (SeBackupPrivilege, SeRestorePrivilege) assigned to svc_backup on SRV-FILE01
028 2026-03-15 06:50:33   CrowdStrike   MED       WKS-JPARK — Microsoft Defender real-time protection disabled via registry modification — user: j.park (help desk ticket #4521 — user disabled for software install troubleshooting, likely benign)
029 2026-03-15 06:55:00   Suricata      HIGH      ET EXPLOIT EternalBlue Attempt — 10.20.30.45 -> 10.20.30.15 (SRV-PRINT01) on TCP/445 — MS17-010 exploitation attempt
030 2026-03-15 06:55:03   WindowsEvt    CRIT      Event ID 4624 — Logon Type 3 — SYSTEM account active on SRV-PRINT01 from 10.20.30.45 — successful exploitation via vulnerable SMBv1 service
031 2026-03-15 06:56:22   CrowdStrike   CRIT      Lateral movement confirmed — new CobaltStrike beacon on SRV-PRINT01 (10.20.30.15), callback to 198.51.100[.]22:443, user: SYSTEM
032 2026-03-15 06:58:00   Firewall      INFO      Allowed DNS 10.20.30.15 -> 10.20.30.2 (internal DNS) — lookup for srv-dc01.globex.local (could be recon or normal)
033 2026-03-15 07:02:44   Sysmon        HIGH      Process Create — SRV-PRINT01: net.exe localgroup administrators, user: SYSTEM — local admin group enumeration
034 2026-03-15 07:05:18   WindowsEvt    HIGH      Event ID 4728 — User svc_backup added to Domain Admins group on SRV-DC01 — changed by: SYSTEM (from SRV-PRINT01)
035 2026-03-15 07:05:19   WindowsEvt    CRIT      Event ID 4672 — Special privileges (all) assigned to svc_backup — account now has Domain Admin rights
036 2026-03-15 07:10:00   Suricata      LOW       DNS TXT query from WKS-LRODRIGUEZ for _dmarc.globex.com — benign, email validation
037 2026-03-15 07:15:30   CrowdStrike   HIGH      Data staging detected — SRV-FILE01: 7z.exe compressing \\SRV-FILE01\Finance\Q1-Reports\*.xlsx and \\SRV-FILE01\HR\Compensation\*.csv to C:\Temp\archive.7z, user: svc_backup — 847 MB total
038 2026-03-15 07:15:31   Sysmon        MED       File Create — SRV-FILE01: C:\Temp\archive.7z — size: 214 MB (compressed from 847 MB)
039 2026-03-15 07:18:00   WindowsEvt    LOW       Event ID 4634 — Logoff for t.nguyen from WKS-TNGUYEN — end of overnight shift (routine)
040 2026-03-15 07:22:45   Suricata      CRIT      ET EXFIL Large Outbound Transfer — SRV-FILE01 (10.20.30.10) -> 203.0.113[.]77:443 — 214 MB HTTPS upload over 4 minutes — destination: cloud storage endpoint (mega[.]nz)
041 2026-03-15 07:22:46   Firewall      HIGH      Unusual outbound traffic — SRV-FILE01 -> 203.0.113[.]77:443 — server has no business reason for outbound HTTPS to external cloud storage
042 2026-03-15 07:23:00   DLP           CRIT      Data loss prevention alert — 214 MB exfiltration detected from SRV-FILE01 to external IP 203.0.113[.]77 — file type: 7z archive — classification: CONFIDENTIAL content detected (Finance, HR data)
043 2026-03-15 07:25:00   CrowdStrike   LOW       Scheduled task created on SRV-BACKUP01 — task: "WindowsHealthCheck", runs daily at 03:00 — legitimate IT automation (matches change ticket #CT-2026-0312)
044 2026-03-15 07:30:15   Suricata      MED       DNS query from SRV-PRINT01 for ns1.c2-relay-node[.]net — known C2 infrastructure domain (threat intel match)
045 2026-03-15 07:35:00   CrowdStrike   HIGH      Persistence mechanism detected — SRV-PRINT01: registry Run key added: HKLM\Software\Microsoft\Windows\CurrentVersion\Run\PrintMon = "C:\Windows\Temp\svcmon.exe" — unsigned binary
046 2026-03-15 07:40:00   AzureAD       MED       Password reset for m.chen initiated from IP 185.220.101[.]34 (Tor exit node) — MFA challenge sent but not completed
047 2026-03-15 07:42:00   ExchGateway   LOW       Outbound email from a.kumar@globex.com to personal Gmail — no sensitive content (DLP clean)
048 2026-03-15 07:55:22   Suricata      LOW       ET INFO TLS Handshake from SRV-WEB01 to cdn.jsdelivr.net — benign CDN traffic for hosted web application
049 2026-03-15 08:10:00   CrowdStrike   MED       WKS-MCHEN — additional reconnaissance: systeminfo.exe, ipconfig /all, tasklist /v executed in rapid succession — attacker profiling host
050 2026-03-15 08:30:00   WindowsEvt    LOW       Event ID 4648 — Explicit credential logon: j.martinez on WKS-JMARTINEZ using RunAs — matches IT troubleshooting ticket (routine)
051 2026-03-15 08:45:12   Suricata      HIGH      ET MALWARE CobaltStrike DNS Beacon — SRV-PRINT01 sending encoded DNS TXT queries to c2-relay-node[.]net at regular 60-second intervals
052 2026-03-15 09:00:00   Firewall      LOW       Denied inbound SSH from 45.33.32.156 to DMZ-WEB01 — brute force attempt, 23 attempts in 5 min, IP blacklisted (automated, external scanner)
053 2026-03-15 09:15:00   CrowdStrike   LOW       Software inventory scan ran on all endpoints — scheduled weekly task, no anomalies (routine)
054 2026-03-15 09:30:44   Sysmon        HIGH      Process Create — SRV-FILE01: vssadmin.exe delete shadows /all /quiet — shadow copy deletion, user: svc_backup — possible ransomware preparation or anti-forensics
055 2026-03-15 09:35:00   WindowsEvt    MED       Event ID 1102 — Security event log cleared on SRV-PRINT01 — anti-forensics activity
056 2026-03-15 09:40:00   Suricata      LOW       ET POLICY Outbound SSH from DMZ-WEB01 to GitHub (benign — automated deployment pull)
057 2026-03-15 10:00:00   CrowdStrike   INFO      Daily threat intelligence feed update completed — 342 new IOCs ingested
058 2026-03-15 10:15:33   WindowsEvt    HIGH      Event ID 4720 — New user account created: "support_admin" on SRV-DC01 by svc_backup — backdoor account
059 2026-03-15 10:15:34   WindowsEvt    HIGH      Event ID 4728 — User support_admin added to Domain Admins group on SRV-DC01
060 2026-03-15 10:30:00   Firewall      LOW       Allowed HTTPS from WKS-DKIM to outlook.office365.com — routine email sync
061 2026-03-15 10:45:00   Suricata      MED       ET SCAN Nmap SYN Scan Detected — external IP 198.51.100[.]99 scanning DMZ range 10.10.10.0/24 — 500+ ports — likely automated internet scanner (not related to internal incident)
062 2026-03-15 11:00:00   CrowdStrike   LOW       Endpoint agent updated on 47 workstations — version 7.14.16703 (routine patch Tuesday push)
063 2026-03-15 11:15:22   Sysmon        HIGH      File Create — SRV-DC01: C:\Windows\Temp\ntds_dump.dit — NTDS.dit database copied, user: svc_backup — full domain credential extraction
064 2026-03-15 11:30:00   WindowsEvt    LOW       Event ID 4624 — Logon Type 2 (Interactive) — r.patel logged into WKS-RPATEL — normal morning login
065 2026-03-15 11:45:00   Suricata      CRIT      ET EXFIL DNS Tunneling Detected — SRV-DC01 sending abnormally large DNS TXT responses to ns1.c2-relay-node[.]net — encoded data in queries averaging 230 bytes each, 400+ queries in 15 min

===============================================================================
  END OF ALERT FEED
  Total alerts: 65
  Severity breakdown: CRIT=5, HIGH=18, MED=13, LOW=19, INFO=5
  Recommended immediate actions: Triage CRIT and HIGH alerts first.
  Student task: Classify each alert as TRUE POSITIVE, FALSE POSITIVE, or
  BENIGN/EXPECTED. Reconstruct the full attack timeline. Identify the
  kill chain stages and map to MITRE ATT&CK techniques.
===============================================================================
