SOC Dashboard Simulator

SIEM Signallar Navbati (Tier 1 Triage) 3 XAVF

Quyidagi signallardan birini tanlang. Telemetriya loglarini tahlil qiling va kiber-hujumni bartaraf eting:

🚨 [CRITICAL] Web Shell Command Execution T1059.004

Host: web-srv-01.corp | Parent: nginx → Child: /bin/bash whoami

FAOL XAVF

⚠️ [HIGH] SSH Brute-Force Password Spray T1110.001

Src IP: 194.26.29.41 | 140 Failed root logins / 30s | Port: 22

FAOL XAVF

🔍 [MEDIUM] Lateral Movement SMB Port Probe T1021.002

Src: 10.0.4.15 → Dst: 10.0.4.1 (Domain Controller) | Port: 445

TAHLILDA

🚨 Tergov: Web Shell Command Execution TIER 2 RESPONDER

MITRE ATT&CK: T1059.004 (Unix Shell) Zararlangan xost: web-srv-01 (10.0.4.5)

Xom Telemetriya Logi (Syslog / Auditd):

type=SYSCALL arch=c000003e syscall=execve success=yes exit=0 comm="whoami" exe="/usr/bin/whoami" ppid=1420 pid=8941 ppid_exe="/usr/sbin/nginx" user="www-data" cwd="/var/www/html/uploads" CommandLine: "/bin/bash -c whoami; id; cat /etc/passwd"

Xavf Tahlili: Nginx veb-serveri foydalanuvchisi (www-data) orqali kiber-hujumchi veb-shell yuklagan va serverda maxfiy buyruqlarni ishga tushirmoqda!

Tezkor Bartaraf Qilish Amallari:

Sigma Qoidasi Muharriri (YAML Sintaksisi) SIGMA SPEC v1.1

Nginx orqali veb-shell ishga tushirilishini barcha SIEM lar (Splunk, Elastic, Wazuh)da tutib oluvchi universal Sigma qoidasini tekshiring:

title: Suspicious Web Shell Execution by Nginx
id: 8b31ea90-281b-4f0e-a342-9901fa32bf11
status: production
description: Detects command execution spawned by web servers
logsource:
    category: process_creation
    product: linux
detection:
    selection_parent:
        ParentImage|endswith:
            - '/nginx'
            - '/apache2'
    selection_cmd:
        Image|endswith:
            - '/whoami'
            - '/id'
            - '/bash'
    condition: selection_parent and selection_cmd
level: high

Tekshirish kutilmoqda...

Kompilyatsiya Natijasi (SIEM So'rovlari) AUTOMATIC

Yagona Sigma qoidasi barcha SIEM tizimlari uchun tayyor so'rovga o'giriladi:

Splunk SPL So'rovi:

index=linux_logs (ParentImage="*/nginx" OR ParentImage="*/apache2") AND (Image="*/whoami" OR Image="*/id" OR Image="*/bash")

Elasticsearch Lucene KQL:

process.parent.executable: (*nginx OR *apache2) AND process.executable: (*whoami OR *id OR *bash)

Muhandislik Qoidasi: Kompaniya SIEM provayderini o'zgartirsa ham xavfsizlik qoidalari saqlanib qoladi!

NIST SP 800-61 Kiber-Insident & Blameless Post-Mortem GOOGLE SRE

Kiber-xavfsizlik madaniyati xodimlarni jazolash emas, balki xato qayta takrorlanmasligi uchun tizimga qat'iy to'siqlar qo'yishdir. Web-Shell insidentining "5 Nega?" zanjirini yakunlang:

1. NEGA?

Nega corp veb-serveri buzildi?

Chunki buzg'unchi /uploads papkasiga cmd.php veb-shellini yuklab, uni ishga tushirdi.

2. NEGA?

Nega PHP skripti uploads papkasida ishga tusha oldi?

Chunki Nginx konfiguratsiyasida yuklangan fayllar papkasi uchun PHP ijrosi taqiqlanmagan edi.

3. NEGA?

Nega xavfli konfiguratsiya serverga chiqib ketdi?

Chunki xodimlar yangilanishni shoshilinch qo'lda o'rnatgan, xavfsizlik tekshiruvidan o'tkazmagan.

4. NEGA?

Nega CI/CD da avtomatik xavfsizlik testlari bo'lmagan?

Chunki kompaniya konveyerida Nginx/Linux sozlamalarini tekshiruvchi avtomatik skaner o'rnatilmagan edi.

5. ILDIZ SABAB

Ildiz Sabab va Tizimli Muhandislik Yechimi:

CI/CD ga majburiy IaC Security Gate qo'shish: agar uploads papkasida bajarilish huquqi bo'lsa, avtomatik deploy to'xtatiladi!

SOC va Insident Boshqaruvi Kvestlari (10 Ball) 10 Ballik Mezon

SOC xavfsizlik markazining 4 ta muhim kiber-topshirig'ini bajaring va 10 ballni qo'lga kiriting:

2 BALL

1-Kvest: SSH Brute-Force Hujumini Bartaraf Etish

1-tabda 2-signalni (SSH Brute-Force) tanlang va buzg'unchining 194.26.29.41 IP-sini UFW xavfsizlik devori orqali bloklang.

3 BALL

2-Kvest: Buzilgan Xostni Tarmoqdan Uzish (EDR Izolyatsiya)

1-kritik signaldagi (Web Shell) serverni tarmoqdan to'liq uzing (EDR Izolyatsiya) va hujumning ichki tarmoqqa tarqalishini to'xtating.

3 BALL

3-Kvest: Universal Sigma Qoidasini Tekshirish

2-tabda "Qoidani Sinovdan O'tkazish" tugmasini bosing va qoidaning Splunk hamda Elastic formatlariga xatosiz o'girilishini tekshiring.

2 BALL

4-Kvest: 5 Whys va Rasmiy Post-Mortem Tahlili

3-tabda 5 Nega? zanjirini ko'rib chiqing va MTTD/MTTR ko'rsatkichlari bilan rasmiy Post-Mortem hisobotini yarating.

Sizning umumiy ballingiz:

0 / 10 BALL