SOC Lab Investigations on Lorenzo Swany — Website Portfolio

Case A – Authentication Abuse & Brute Force Detection

Mon, 01 Jan 0001 00:00:00 +0000

Case A – Authentication Abuse & Brute Force Detection#

MITRE ATT&CK#

Tactic: Initial Access
Technique: T1110.003 – Brute Force: Password Spraying

This project demonstrates detection and investigation of repeated failed network authentication attempts using Windows Security logs and Splunk.

Scenario#

A Windows host begins receiving multiple failed remote logon attempts from a single source IP within a short period of time. The objective is to determine whether the activity represents brute-force behavior, password spraying, or benign misconfiguration.

Case B - Suspicious PowerShell Execution

Mon, 01 Jan 0001 00:00:00 +0000

Case B – Suspicious PowerShell Execution#

MITRE ATT&CK#

Tactic: Execution
Technique: T1059.001 – Command and Scripting Interpreter: PowerShell

This project demonstrates detection and investigation of suspicious PowerShell activity using Windows Security process creation logs and Splunk.

Scenario#

PowerShell execution was observed on a Windows endpoint from a standard user account. Because PowerShell is frequently abused by attackers for script execution, payload retrieval, and system reconnaissance, the activity was reviewed to determine whether the behavior represented legitimate administrative use or potentially malicious script execution.

Case C – Unexpected Scheduled Task Creation

Mon, 01 Jan 0001 00:00:00 +0000

Case C – Unexpected Scheduled Task Creation#

MITRE ATT&CK#

Tactic: Persistence
Technique: T1053.005 – Scheduled Task/Job: Scheduled Task

This project demonstrates detection and investigation of a suspicious scheduled task created on a Windows endpoint, using Windows Security logs and Splunk.

Scenario#

A scheduled task was created on a Windows endpoint outside of expected administrative activity. Because scheduled tasks are frequently used by attackers to maintain persistent access across reboots, the activity was reviewed to determine whether the task was legitimate or a potential persistence mechanism.