88 أسطر
4.1 KiB
Markdown
88 أسطر
4.1 KiB
Markdown
| Time | Event |
|
|
|--------|-------|
|
|
| 09:40 | Unusual volume of `POST` requests to `/api/login` detected from a single IP. |
|
|
| 09:42 | Failed login attempts exceed **300** within one minute. |
|
|
| 09:44 | No rate limiting or temporary IP blocking was triggered. |
|
|
| 09:46 | One login attempt succeeds using a password from a common wordlist (e.g., `rockyou.txt`). |
|
|
| 09:47 | The server issues a valid JWT for the compromised account. |
|
|
| 09:49 | The attacker uses the JWT to access `/api/users/me`. |
|
|
| 09:51 | The attacker begins probing undocumented API endpoints (shadow APIs). |
|
|
| 09:54 | Sensitive data is exfiltrated through repeated API requests. |
|
|
| 09:58 | The SOC team detects the incident through a SIEM alert triggered by an abnormal spike in HTTP 401 responses. |
|
|
|
|
|
|
## Incident Response Plan
|
|
|
|
### 1. Identification
|
|
- Review API, application, and authentication logs.
|
|
- Identify the source IP addresses responsible for the brute force attack.
|
|
- Determine which user accounts were compromised.
|
|
- Analyze the scope of the data accessed or exfiltrated.
|
|
- Correlate events using the SIEM to establish the attack timeline.
|
|
|
|
### 2. Containment
|
|
- Block the attacker's IP address using the firewall or Web Application Firewall (WAF).
|
|
- Temporarily disable the compromised user account.
|
|
- Revoke all active JWT access tokens and terminate existing sessions.
|
|
- Enable temporary rate limiting on the `/api/login` endpoint.
|
|
- Isolate affected containers if compromise is suspected.
|
|
|
|
### 3. Eradication
|
|
- Reset passwords for affected accounts.
|
|
- Remove any malicious processes or unauthorized changes.
|
|
- Patch the authentication service to enforce rate limiting and account lockout.
|
|
- Verify container images for integrity and rebuild compromised containers from trusted images.
|
|
- Scan systems for indicators of compromise (IOCs).
|
|
|
|
### 4. Recovery
|
|
- Restore normal service after confirming the environment is secure.
|
|
- Re-enable affected user accounts with new credentials.
|
|
- Continue monitoring logs for suspicious authentication attempts.
|
|
- Validate that security controls (MFA, rate limiting, monitoring) are functioning correctly.
|
|
## Preventing the Attack on Ghaymah
|
|
|
|
### 1. Network Policies
|
|
|
|
- Apply **Rate Limiting** on the `/api/login` endpoint to limit the number of login attempts from a single IP address.
|
|
- Configure **Kubernetes Network Policies** so that only the API service can communicate with the PostgreSQL database.
|
|
- Deploy a **Web Application Firewall (WAF)** to filter malicious requests and block brute force attacks.
|
|
- Restrict access to internal services by allowing traffic only from trusted containers and namespaces.
|
|
- Enable automatic IP blocking after multiple failed authentication attempts.
|
|
- Encrypt all communication using **HTTPS/TLS** to protect authentication traffic.
|
|
|
|
### 2. Container Security
|
|
|
|
- Run containers as **non-root** users to minimize the impact of a container compromise.
|
|
- Use trusted and regularly updated base images to reduce known vulnerabilities.
|
|
- Store passwords, API keys, and JWT secrets in **Kubernetes Secrets** or a secure secret manager instead of environment variables or Docker images.
|
|
- Continuously scan container images with tools such as **Trivy** before deployment.
|
|
- Apply the **Principle of Least Privilege** by granting containers only the permissions they require.
|
|
- Enable centralized logging and monitoring for all containers to quickly detect suspicious authentication activity.
|
|
|
|
## Alert Rule (Splunk SPL)
|
|
normally request look something like
|
|
```json
|
|
{
|
|
"timestamp": "2026-07-27T09:42:11Z",
|
|
"src_ip": "192.168.1.50",
|
|
"endpoint": "/api/login",
|
|
"method": "POST",
|
|
"status": 401,
|
|
"username": "admin",
|
|
"user_agent": "Mozilla/5.0"
|
|
}
|
|
```
|
|
so we can make SPL code like
|
|
```spl
|
|
index=api_logs endpoint="/api/login" status=401
|
|
| bucket span=1m _time
|
|
| stats count by src_ip, _time
|
|
| where count >= 20
|
|
```
|
|
|
|
**Alert Condition**
|
|
|
|
- Trigger when a single IP generates **20 or more failed login attempts within 1 minute**.
|
|
- Alert severity: **High**.
|
|
- Send an email notification to the SOC team.
|
|
- Automatically block the source IP for 15 minutes using the firewall or WAF. |