Aurelius Blue Alert Lab: Alert Practice

True Positive. The evidence shows that the nginx/php-fpm web context launched dash with sh -c id from a CMS plugin directory. This combination of web user, php-fpm8.2 parent process, working directory under plugins, and command execution confirms suspicious activity.

host.name: "ORION-WEB" and process.name: "dash"

AUR-EVT-000003; AUR-EVT-000004; AUR-EVT-000005

True Positive. The nginx user executed commands such as cat /etc/passwd and ls -la /home/elena. Enumerating accounts and user directories from a web context is not normal application behavior, so the alert is confirmed.

host.name: "ORION-WEB" and process.command_line: (*passwd* or */home/elena*)

AUR-EVT-000006; AUR-EVT-000007

True Positive. There is evidence of access to /home/elena/.ssh, including listing or reading SSH material from a web context. A process associated with nginx should not inspect SSH keys or SSH directories belonging to local users, so this case is a true positive.

host.name: "ORION-WEB" and file.path: */home/elena/.ssh*

AUR-EVT-000008; AUR-EVT-000009

True Positive. php-fpm8.2 made outbound connections to 10.10.22.45 after command execution on the web server. An outbound connection from a web process to a suspicious IP address on unusual ports confirms the alert.

host.name: "ORION-WEB" and destination.ip: "10.10.22.45"

AUR-EVT-000010

False Positive. The command df -k /opt/forgeci/workspace was executed by builder as a normal CI service check. There is no use of /tmp, sudo, credential access, payload, or suspicious command chain. For that reason, it is dismissed as a false positive.

host.name: "FORGE-CI" and process.command_line: "df -k /opt/forgeci/workspace"

AUR-EVT-000012

True Positive. The builder user read /home/builder/.bash_history from an interactive shell. Access to shell history can reveal commands, sensitive paths, or secrets accidentally typed into the shell, so the alert is confirmed.

host.name: "FORGE-CI" and file.path: */.bash_history

AUR-EVT-000014

True Positive. builder executed sudo -l from an interactive shell. This command is used to discover available sudo privileges and, in this context, is part of local reconnaissance activity. It is classified as a true positive.

host.name: "FORGE-CI" and process.command_line: "sudo -l"

AUR-EVT-000016

True Positive. builder executed chmod +x on a file located in /tmp, and related activity appears afterward. Adding execute permissions to a temporary file is a strong indicator of preparation for suspicious execution.

host.name: "FORGE-CI" and process.command_line: *chmod* and process.working_directory: "/tmp"

AUR-EVT-000018

False Positive. The connections were made by apt-helper or unattended-upgrade to package mirrors over ports 80/443. There are no suspicious commands nearby, unusual destinations, or relationship with unauthorized access activity. This is normal update traffic.

host.name: "ATLAS-MAIL" and process.name: ("apt-helper" or "unattended-upgrade")

AUR-EVT-000020; AUR-EVT-000021; AUR-EVT-000022

True Positive. Multiple IMAP authentication failures were observed from 10.10.22.45 against port 993. Repeated attempts from the same IP address against a mail service indicate suspicious authentication activity, so the alert is true.

host.name: "ATLAS-MAIL" and destination.port: 993 and source.ip: "10.10.22.45"

AUR-EVT-000024; AUR-EVT-000025; AUR-EVT-000026; AUR-EVT-000027; AUR-EVT-000028; AUR-EVT-000029

True Positive. root executed /home/mateo/.mail-sync.sh, and child actions such as tar or rm were observed afterward. Root executing a script located in a user profile is anomalous and enough to confirm the alert.

host.name: "ATLAS-MAIL" and process.command_line: */home/mateo/.mail-sync.sh*

AUR-EVT-000030; AUR-EVT-000031

False Positive. An anonymous SMB logon exists, but it is an isolated event and there is no follow-up evidence of share enumeration, remote execution, multiple failures, lateral movement, or relevant activity afterward. Without additional evidence, it is classified as a false positive.

host.name: "LYRA-FS" and user.name: "ANONYMOUS LOGON"

AUR-EVT-000033

True Positive. Several 4625 events with LogonType 3 were observed from 10.10.22.45 against multiple SMB users. The combination of the same source, multiple users, and repeated failures matches a password spraying pattern.

host.name: "LYRA-FS" and event.code: "4625" and source.ip: "10.10.22.45"

AUR-EVT-000035; AUR-EVT-000036; AUR-EVT-000037; AUR-EVT-000038; AUR-EVT-000039; AUR-EVT-000040

True Positive. PowerShell read ConsoleHost_history.txt and searched for password-related strings. Searching PowerShell history can reveal credentials or sensitive commands, so it is considered a true positive.

host.name: "VEGA-WS" and process.command_line: *ConsoleHost_history.txt*

AUR-EVT-000041

True Positive. A 4624 LogonType 10 login for Administrator was observed from 10.10.22.45, followed by special privilege assignment. A privileged RDP login from a suspicious source confirms the alert.

host.name: "NOVA-ADM" and event.code: "4624" and winlog.event_data.LogonType: "10"

AUR-EVT-000043; AUR-EVT-000044

True Positive. PowerShell created C:\Users\Administrator\AppData\Local\syncsvc.exe. Creating an executable in AppData under an administrator profile, especially after a suspicious login, is clear evidence of anomalous activity.

host.name: "NOVA-ADM" and file.path: *AppData\\Local\\syncsvc.exe

AUR-EVT-000045; AUR-EVT-000046

True Positive. Event 4698 shows the creation of the \SystemSyncCheck task, pointing to the syncsvc.exe executable inside Administrator AppData. A scheduled task that runs binaries from a user profile is suspicious and confirms persistence.

host.name: "NOVA-ADM" and event.code: "4698" and winlog.event_data.TaskName: "\\SystemSyncCheck"

AUR-EVT-000047

False Positive. rundll32.exe executed shell32.dll from C:\Windows\System32 with explorer.exe as the parent process and normal COM arguments. There is no DLL in a suspicious path, encoded PowerShell, or associated payload. For that reason, it is a false positive.

host.name: "NOVA-ADM" and process.name: "rundll32.exe"

AUR-EVT-000049

False Positive. Access to lsass.exe was performed by svchost.exe under NT AUTHORITY\SYSTEM, with services.exe as the parent process. There is no evidence of a dump, mimikatz, suspicious PowerShell, or comsvcs.dll. The activity matches normal system behavior.

host.name: "VEGA-WS" and event.code: "10" and target.process.name: "lsass.exe"

AUR-EVT-000051