2nd task

Attack_Simulation/README.md

@@ -0,0 +1,41 @@
+| Time  | Event |
+|--------|-------|
+| 09:40 | Unusual volume of `POST` requests to `/api/login` detected from a single IP. |
+| 09:42 | Failed login attempts exceed **300** within one minute. |
+| 09:44 | No rate limiting or temporary IP blocking was triggered. |
+| 09:46 | One login attempt succeeds using a password from a common wordlist (e.g., `rockyou.txt`). |
+| 09:47 | The server issues a valid JWT for the compromised account. |
+| 09:49 | The attacker uses the JWT to access `/api/users/me`. |
+| 09:51 | The attacker begins probing undocumented API endpoints (shadow APIs). |
+| 09:54 | Sensitive data is exfiltrated through repeated API requests. |
+| 09:58 | The SOC team detects the incident through a SIEM alert triggered by an abnormal spike in HTTP 401 responses. |
+
+
+## Incident Response Plan
+
+### 1. Identification
+- Review API, application, and authentication logs.
+- Identify the source IP addresses responsible for the brute force attack.
+- Determine which user accounts were compromised.
+- Analyze the scope of the data accessed or exfiltrated.
+- Correlate events using the SIEM to establish the attack timeline.
+
+### 2. Containment
+- Block the attacker's IP address using the firewall or Web Application Firewall (WAF).
+- Temporarily disable the compromised user account.
+- Revoke all active JWT access tokens and terminate existing sessions.
+- Enable temporary rate limiting on the `/api/login` endpoint.
+- Isolate affected containers if compromise is suspected.
+
+### 3. Eradication
+- Reset passwords for affected accounts.
+- Remove any malicious processes or unauthorized changes.
+- Patch the authentication service to enforce rate limiting and account lockout.
+- Verify container images for integrity and rebuild compromised containers from trusted images.
+- Scan systems for indicators of compromise (IOCs).
+
+### 4. Recovery
+- Restore normal service after confirming the environment is secure.
+- Re-enable affected user accounts with new credentials.
+- Continue monitoring logs for suspicious authentication attempts.
+- Validate that security controls (MFA, rate limiting, monitoring) are functioning correctly.