SOC Operations dan Incident Triage

# =============================================
# Contoh Alert: Brute Force Detection
# =============================================

# Alert Details:
# Name: Multiple Failed Login Attempts
# Source: Active Directory
# Timestamp: 2024-01-15 03:22:45 WIB
# Count: 47 failed attempts in 5 minutes
# Target: DC-FINANCE-01 (Domain Controller)
# Source IP: 10.10.50.23 (Workstation HR)
# Account: administrator

# TRIAGE ANALYSIS
# =================================================

# Step 1: Verify alert validity
# - Check if IP belongs to legitimate scanner
# - Verify with asset inventory
# - Check if there's a maintenance window

# Step 2: Context enrichment
# - User "administrator" is sensitive account
# - DC-FINANCE-01 is critical asset
# - Source workstation belongs to HR department
# - Time 03:22 is outside business hours

# Step 3: Severity determination
# - Target: Critical (Domain Controller)
# - Account: Critical (administrator)
# - Time: Suspicious (after hours)
# - Volume: High (47 attempts)
# => SEVERITY: P1 — CRITICAL

# Step 4: Immediate actions
# 1. Block source IP at firewall
netsh advfirewall firewall add rule name="BLOCK-BF" \
  dir=in action=block remoteip=10.10.50.23

# 2. Disable compromised account
net user administrator /active:no

# 3. Check for successful login
# Query: Did any login succeed from this IP?
index=windows EventCode=4624 IpAddress="10.10.50.23"
  Account_Name="administrator"

# 4. Isolate affected workstation
# (via EDR or network segmentation)

# =============================================
# Risk Scoring Engine untuk Alert Prioritization
# =============================================

class AlertRiskScorer:
    def __init__(self):
        self.asset_weights = {
            "domain_controller": 10,
            "database_server": 9,
            "web_server": 7,
            "workstation": 4,
            "printer": 1
        }
        self.time_multiplier = {
            "business_hours": 1.0,
            "after_hours": 1.3,
            "holiday": 1.5
        }

    def calculate_score(self, alert):
        base_score = 0
        # Factor 1: Asset Criticality (0-30)
        asset_type = alert.get("asset_type", "workstation")
        base_score += self.asset_weights.get(asset_type, 4) * 3
        # Factor 2: Threat Intel Match (0-25)
        if alert.get("threat_intel_match"):
            base_score += 25
        # Factor 3: Attack Confidence (0-20)
        confidence = alert.get("confidence", 0.5)
        base_score += int(confidence * 20)
        # Factor 4: User Risk (0-15)
        if alert.get("privileged_user"):
            base_score += 15
        else:
            base_score += 5
        # Factor 5: Time-based (multiplier)
        time_factor = self.time_multiplier.get(
            alert.get("time_category"), 1.0)
        base_score = int(base_score * time_factor)
        return min(max(base_score, 0), 100)

    def get_priority(self, score):
        if score >= 80: return "P1 — Critical"
        if score >= 60: return "P2 — High"
        if score >= 40: return "P3 — Medium"
        return "P4 — Low"

# Contoh penggunaan
scorer = AlertRiskScorer()
alert = {
    "asset_type": "domain_controller",
    "threat_intel_match": True,
    "confidence": 0.85,
    "privileged_user": True,
    "time_category": "after_hours"
}
score = scorer.calculate_score(alert)
priority = scorer.get_priority(score)
print(f"Risk Score: {score}/100 — {priority}")
# Output: Risk Score: 97/100 — P1 — Critical

# =============================================
# Sigma Rule: Credential Dumping Detection
# =============================================
title: Credential Dumping via LSASS Access
id: a1234567-89ab-cdef-0123-456789abcdef
status: production
description: Detects suspicious access to LSASS process

logsource:
  category: process_access
  product: windows

detection:
  selection:
    TargetImage|endswith: '\lsass.exe'
    GrantedAccess|contains:
      - '0x1010'
      - '0x1410'
      - '0x1438'
  filter:
    SourceImage|endswith:
      - '\wmiprvse.exe'
      - '\taskmgr.exe'
  condition: selection and not filter

falsepositives:
  - Legitimate security tools
  - System processes

level: high
tags:
  - attack.credential_access
  - attack.t1003.001

# =============================================
# INCIDENT RESPONSE PLAYBOOK: RANSOMWARE
# =============================================

# PHASE 1: DETECTION & TRIAGE (0-30 menit)
# =================================================
# 1. Identifikasi indikator ransomware:
#    - Mass file extension changes
#    - Ransom note files appearing
#    - Unusual process execution
#    - Volume shadow copy deletion
#    - High CPU/disk I/O

# 2. Validasi alert:
#    - Verify file encryption evidence
#    - Check for ransom note content
#    - Identify ransomware variant (ID Ransomware)

# 3. Severity: P1 — CRITICAL

# PHASE 2: CONTAINMENT (30 menit - 2 jam)
# =================================================
# 1. Network isolation:
#    - Disconnect affected hosts from network
#    - Block lateral movement paths
#    - Isolate network segments

# 2. Account security:
#    - Force password reset for compromised accounts
#    - Disable suspicious service accounts
#    - Review and revoke VPN access

# 3. Evidence preservation:
#    - Capture memory dump
#    - Image affected systems
#    - Collect logs from all sources
#    - Document timeline

# PHASE 3: ERADICATION (2-24 jam)
# =================================================
# 1. Malware removal:
#    - Identify all affected systems
#    - Remove malware artifacts
#    - Patch exploited vulnerabilities

# 2. Root cause analysis:
#    - Initial infection vector
#    - Privilege escalation path
#    - Lateral movement methods

# PHASE 4: RECOVERY (1-7 hari)
# =================================================
# 1. System restoration:
#    - Restore from clean backups
#    - Verify system integrity
#    - Rebuild compromised systems

# 2. Monitoring:
#    - Enhanced monitoring for 30 days
#    - Watch for re-infection indicators

# PHASE 5: LESSONS LEARNED (7-14 hari)
# =================================================
# 1. Post-incident review meeting
# 2. Update detection rules
# 3. Improve security controls
# 4. Update this playbook

# =============================================
# SOAR Playbook: Automated Phishing Response
# =============================================

class PhishingPlaybook:
    def __init__(self, siem, email, edr):
        self.siem = siem
        self.email = email
        self.edr = edr

    def execute(self, alert):
        # Step 1: Extract IOCs
        iocs = self.extract_iocs(alert["email_data"])
        # Step 2: Threat intel lookup
        ti = self.threat_intel_lookup(iocs)
        malicious_score = ti.get("score", 0)

        if malicious_score > 70:
            # Step 3a: Auto remediate
            self.quarantine_email(alert["msg_id"])
            self.block_sender(alert["sender"])
            self.block_urls(iocs["urls"])
            # Step 4: Check link clicks
            affected = self.check_url_clicks(iocs["urls"])
            if affected:
                self.isolate_endpoints(affected)
                self.reset_passwords(affected)
            return {"action": "auto_remediated"}
        else:
            # Step 3b: Escalate to analyst
            self.create_ticket(alert, ti)
            return {"action": "escalated"}

    def extract_iocs(self, email_data):
        import re
        urls = re.findall(
            r'https?://[^\s<>"]+', email_data.get("body", ""))
        return {
            "sender": email_data.get("from"),
            "subject": email_data.get("subject"),
            "urls": urls,
            "attachments": email_data.get("attachments", [])
        }