Incident Response Playbooks: Multi-Scenario Lab
Simulated full-lifecycle Incident Response workflows (Detection, Analysis, Containment, Eradication, Recovery) across real-world adversary scenarios in an isolated VirtualBox lab. Integrated host-based detection via Wazuh EDR with network-based detection via Suricata NIDS against Metasploitable2 and DVWA targets. Executed Scenario 1 (SSH brute-force credential attacks) with automated iptables active response containment, triaging three layers of infrastructure failure (manager daemon crash, indexer process termination, and agent ID mismatches from hostname shifts). Executed Scenario 2 (Web application attacks featuring SQL injection and webshell RCE), uncovering two critical detection gaps in Suricata EXTERNAL_NET routing and missing HTTP inspection signatures, followed by engineering a custom Suricata rule (SID 9000001). Formalized standard operating procedures and executable YAML playbooks for both incident response lifecycles.
Executed 2 multi-vector attack scenarios end-to-end, authored 2 executable YAML response playbooks, triaged 5 critical infrastructure and detection failure root causes, engineered custom Suricata rule SID 9000001, and documented 9 comprehensive incident writeups.
Key Metrics & Measurable Impact
Empirical metrics gathered across NIST incident lifecycles, active response containment, and Suricata NIDS rule engineering.
SSH brute force and Web application attack (SQLi + Webshell RCE) complete end-to-end
Machine-readable NIST workflows: playbook-bruteforce.yml and playbook-webapp.yml
Manager crash, indexer termination, agent ID mismatch, EXTERNAL_NET bug, rule path error
Custom NIDS signature SID 9000001 authored to detect active webshell interaction
Organized evidence across setup, attack execution, detection, and response phases
29 completed milestones, 4 planned items across ransomware and final cleanup
Work Artifacts & Key Evidence
Selected technical screenshots and logs. Use the side arrows to scroll or click any card to inspect.
Root Cause: Agent ID Hostname Mismatch
Key root cause analysis for Scenario 1: agent ID misalignment caused by hostname changes, preventing active response execution.
Automated Host Containment (iptables DROP)
Verified automated containment: malicious attacker IP blocked via iptables firewall DROP rule following agent ID resolution.
Webshell Upload & RCE Execution (uid=33)
Adversary Remote Code Execution (RCE) validation: successful command execution via uploaded webshell returning uid=33 (www-data).
Root Cause: Suricata Custom Rule Path Omission
Suricata NIDS root cause triage: identified custom rule load failure resulting from relative directory path discrepancies against default-rule-path.
Custom Suricata Rule Webshell Detection (SID 9000001)
Custom Suricata detection rule validation: high-fidelity signature alert successfully triggered on adversary webshell interaction.
Investigation Timeline
Detection & Multi-Layer Infrastructure Root Cause Triage
Triaged failed active response during Hydra SSH brute force. Traced service failure across 3 root causes: manager crash, indexer process termination from RAM pressure, and agent ID mismatch caused by endpoint hostname modification.
Host-Level Active Response Containment & Session Kill
Restored active response mechanism following agent ID correction. Attacker IP was dropped automatically via iptables firewall rule, complemented by manual session revocation and credential rotation.
Network IDS Integration & EXTERNAL_NET Triage
Deployed Suricata 7 on dedicated Ubuntu VM to monitor Metasploitable2 and DVWA traffic. Discovered detection gap where SQL injection bypassed alerts due to EXTERNAL_NET excluding internal lab subnets; reconfigured YAML definition.
Custom Suricata Signature Authoring for Webshell RCE
Observed that default Suricata rules missed custom PHP webshell command execution. Authored custom signature SID 9000001 inspecting HTTP URI parameters for command execution primitives (cmd=, id, whoami).
Implementation Phases & Checklist
- ✓Initial lab environment provisioning (Kali Linux, Wazuh Server, Endpoint)
- ✓Initial adversary reconnaissance via Nmap (Port 22 SSH identified)
- ✓Wordlist preparation and credential stuffing execution via Hydra
- ✓Alert detection and log analysis via Wazuh rules 40112 and 100002
- ✓Three-tier root cause triage (manager daemon, indexer crash, agent ID mismatch)
- ✓Dual containment execution (Wazuh active response iptables drop and manual session kill)
- ✓Post-compromise bash history audit and artifact inspection
- ✓Formalize executable YAML playbook (playbook-bruteforce.yml)
- ✓Complete 5-part incident report and investigation writeup
- ✓Deploy and configure dedicated Suricata Network IDS VM in promiscuous mode
- ✓Integrate Suricata alerts into Wazuh Manager pipeline (Agent ID 003)
- ✓Comprehensive Nmap port and service reconnaissance against Metasploitable2
- ✓Execute SQL injection testing across error-based and authentication bypass vectors
- ✓Execute webshell upload and verify remote code execution (uid=33 www-data)
- ✓Triage Suricata detection gap: correct EXTERNAL_NET variable misconfiguration
- ✓Author and load custom Suricata detection signature (SID 9000001)
- ✓Execute containment and eradication of web assets and shell scripts
- ✓Formalize executable YAML playbook (playbook-webapp.yml)
- ✓Author complete 4-part incident report and investigation writeup
- ○Finalize formal recovery verification phase documentation
- ✓Structure repository directories and incident scenario indexes
- ✓Document real-world operational startup and troubleshooting SOPs
- ✓Standardize incident report markdown templates adhering to blue team standards
- ○Provision isolated victim workstation and deploy ransomware simulation payload
- ○Analyze process tree modifications, persistence hooks, and lateral movement
- ○Execute rapid host network isolation and identify encryption IOCs
- ○Formalize YAML playbook (playbook-ransomware.yml) and incident writeup
Documentation & Technical Reports
Comprehensive technical analysis, investigation methodology, and formal security documentation for this project are currently being compiled. The full report and lab artifacts will be published here soon.
This project was developed strictly for cybersecurity education, blue team incident response engineering, and professional portfolio demonstration. All adversarial simulations were conducted within an isolated virtual lab environment (VirtualBox Host-only network) targeting intentionally vulnerable systems (DVWA, Metasploitable2) and owned assets exclusively.