Skip to content

06-mitre-attack-mapping.md

Latest commit

 

History

History
77 lines (57 loc) · 5.33 KB

06-mitre-attack-mapping.md

File metadata and controls

77 lines (57 loc) · 5.33 KB
Raw

06 — MITRE ATT&CK Mapping

Each observed behaviour is mapped to the relevant ATT&CK tactic and technique, with the supporting evidence and a detection idea. This turns the investigation into reusable detection logic.

Technique Matrix

Tactic Technique ID Evidence in this investigation
Reconnaissance Active Scanning / target profiling T1595 Heavy HTTP probing of 192.168.250.70 from 40.80.148.42 and 23.22.63.114
Initial Access Exploit Public-Facing Application T1190 Attack against the internet-facing Joomla CMS
Credential Access Brute Force: Password Guessing T1110.001 400+ POST attempts vs. username=admin
Initial Access / Persistence / Priv. Esc. Valid Accounts T1078 Re-use of the compromised admin / batman credential
Execution Command & Scripting Interpreter: Windows Command Shell T1059.003 cmd.exe /c "3791.exe 2>&1" (Sysmon EventCode 1)
Command & Control Ingress Tool Transfer T1105 Upload of 3791.exe to the compromised server
Command & Control Application Layer Protocol T1071 HTTP beacon to ...jumpingcrab.com:1337
Command & Control Dynamic Resolution T1568 C2 via free dynamic DNS (jumpingcrab.com / afraid.org)
Exfiltration Exfiltration Over C2 Channel T1041 Outbound traffic to attacker-controlled infrastructure
Impact Defacement: External Defacement T1491.002 poisonivy-is-coming-for-you-batman.jpeg served from the site

Detection Notes

T1110.001 — Brute Force (Password Guessing)

A single source IP generating a high volume of POST requests to an authentication endpoint in a short window is the core signal.

index=botsv1 sourcetype=stream:http uri="/joomla/administrator/index.php" http_method=POST
| stats count as attempts dc(form_data) as unique_passwords by src_ip
| where attempts > 50

Alerting idea: threshold on attempts per src_ip over a rolling 5-minute window; enrich with User-Agent to distinguish scripted tools (Python-urllib, curl, Hydra).

T1078 — Valid Accounts

Watch for a successful authentication from a source that was also seen brute-forcing, or a login from an unusual User-Agent / geolocation immediately after a burst of failures.

T1059.003 — Windows Command Shell

Non-standard executables spawned by cmd.exe, especially from web-server working directories.

index=botsv1 sourcetype="XmlWinEventLog" EventCode=1 CommandLine="*cmd.exe /c*"
| table _time Computer User ParentImage Image CommandLine

Alerting idea: flag process creation where ParentImage is a web-server or interpreter process and the child is an executable dropped outside standard install paths.

T1071 / T1041 — C2 over HTTP

Outbound connections to newly observed domains on uncommon ports (e.g., 1337), to dynamic-DNS providers, or to URLs categorized as malicious by the web filter.

index=botsv1 sourcetype=fortigate_utm (dstport=1337 OR url="*jumpingcrab*" OR crlevel=high)
| table _time srcip dstip dstport url catdesc crlevel

Alerting idea: correlate FortiGate "Malicious Websites" hits with internal server source IPs — a server initiating such traffic is far more suspicious than a workstation.

T1491.002 — External Defacement

Monitor for unexpected new web assets (especially images with anomalous names) being served or requested on a public site.

Summary

The intrusion is a compact but complete APT chain: exploit a public app → brute-force credentials → re-use a valid account → deliver and execute a RAT → establish C2 → impact (defacement). Mapping it to ATT&CK makes every step detectable and the lessons portable to a production SOC.