42 أسطر
2.1 KiB
Markdown
42 أسطر
2.1 KiB
Markdown
| Time | Event |
|
|
|--------|-------|
|
|
| 09:40 | Unusual volume of `POST` requests to `/api/login` detected from a single IP. |
|
|
| 09:42 | Failed login attempts exceed **300** within one minute. |
|
|
| 09:44 | No rate limiting or temporary IP blocking was triggered. |
|
|
| 09:46 | One login attempt succeeds using a password from a common wordlist (e.g., `rockyou.txt`). |
|
|
| 09:47 | The server issues a valid JWT for the compromised account. |
|
|
| 09:49 | The attacker uses the JWT to access `/api/users/me`. |
|
|
| 09:51 | The attacker begins probing undocumented API endpoints (shadow APIs). |
|
|
| 09:54 | Sensitive data is exfiltrated through repeated API requests. |
|
|
| 09:58 | The SOC team detects the incident through a SIEM alert triggered by an abnormal spike in HTTP 401 responses. |
|
|
|
|
|
|
## Incident Response Plan
|
|
|
|
### 1. Identification
|
|
- Review API, application, and authentication logs.
|
|
- Identify the source IP addresses responsible for the brute force attack.
|
|
- Determine which user accounts were compromised.
|
|
- Analyze the scope of the data accessed or exfiltrated.
|
|
- Correlate events using the SIEM to establish the attack timeline.
|
|
|
|
### 2. Containment
|
|
- Block the attacker's IP address using the firewall or Web Application Firewall (WAF).
|
|
- Temporarily disable the compromised user account.
|
|
- Revoke all active JWT access tokens and terminate existing sessions.
|
|
- Enable temporary rate limiting on the `/api/login` endpoint.
|
|
- Isolate affected containers if compromise is suspected.
|
|
|
|
### 3. Eradication
|
|
- Reset passwords for affected accounts.
|
|
- Remove any malicious processes or unauthorized changes.
|
|
- Patch the authentication service to enforce rate limiting and account lockout.
|
|
- Verify container images for integrity and rebuild compromised containers from trusted images.
|
|
- Scan systems for indicators of compromise (IOCs).
|
|
|
|
### 4. Recovery
|
|
- Restore normal service after confirming the environment is secure.
|
|
- Re-enable affected user accounts with new credentials.
|
|
- Continue monitoring logs for suspicious authentication attempts.
|
|
- Validate that security controls (MFA, rate limiting, monitoring) are functioning correctly.
|