ghaymah-exam-yamin_zeadneh-SecOps/Attack_Simulation/README.md

Time	Event
09:40	Unusual volume of POST requests to /api/login detected from a single IP.
09:42	Failed login attempts exceed 300 within one minute.
09:44	No rate limiting or temporary IP blocking was triggered.
09:46	One login attempt succeeds using a password from a common wordlist (e.g., rockyou.txt).
09:47	The server issues a valid JWT for the compromised account.
09:49	The attacker uses the JWT to access /api/users/me.
09:51	The attacker begins probing undocumented API endpoints (shadow APIs).
09:54	Sensitive data is exfiltrated through repeated API requests.
09:58	The SOC team detects the incident through a SIEM alert triggered by an abnormal spike in HTTP 401 responses.

Incident Response Plan

1. Identification

• Review API, application, and authentication logs.
• Identify the source IP addresses responsible for the brute force attack.
• Determine which user accounts were compromised.
• Analyze the scope of the data accessed or exfiltrated.
• Correlate events using the SIEM to establish the attack timeline.

2. Containment

• Block the attacker's IP address using the firewall or Web Application Firewall (WAF).
• Temporarily disable the compromised user account.
• Revoke all active JWT access tokens and terminate existing sessions.
• Enable temporary rate limiting on the /api/login endpoint.
• Isolate affected containers if compromise is suspected.

3. Eradication

• Reset passwords for affected accounts.
• Remove any malicious processes or unauthorized changes.
• Patch the authentication service to enforce rate limiting and account lockout.
• Verify container images for integrity and rebuild compromised containers from trusted images.
• Scan systems for indicators of compromise (IOCs).

4. Recovery

• Restore normal service after confirming the environment is secure.
• Re-enable affected user accounts with new credentials.
• Continue monitoring logs for suspicious authentication attempts.
• Validate that security controls (MFA, rate limiting, monitoring) are functioning correctly.