DEV Community: Jaime Barreto

LetsDefend SIEM Alert: Follina 0-Day Detected EventID: 123

Jaime Barreto — Mon, 17 Mar 2025 16:26:32 +0000

Hi there!, we're going to analyze and investigate a zero-day vulnerability: the CVE-2022-30190 a.k.a. Follina.

The Follina vulnerability affects the Microsoft Office products and represents a critical risk because it enables remote code execution (RCE).

Key Details of the Follina vulnerability (source https://owasp.org/www-community/vulnerabilities/follina):

CVE-2022-30190: Officially recognized as CVE-2022-30190 by the National Institute of Standards and Technology (NIST), Follina warrants tracking due to its severity.
Phishing Campaigns: Cybercriminals actively exploit Follina through sophisticated phishing campaigns, luring users into opening malicious Office documents or links that trigger the vulnerability.
MSDT Protocol: The critical issue lies in the manipulation of the “Microsoft Support Diagnostic Tool” (MSDT) protocol. Attackers leverage this protocol to execute their own PowerShell commands, often without user interaction.
Diverse Attack Vectors: Follina can strike via email-delivered malicious Office documents, USB devices, or even during file previews (e.g., .rtf formats).
Discovery Timeline: Unveiled as a zero-day vulnerability on May 27, 2022, the first known malware exploiting it surfaced on April 7, 2022, suggesting prior exploitation.
Escalation of Phishing Campaigns: With Follina’s discovery, cybersecurity experts noted a surge in phishing campaigns employing this vulnerability.

Let's create the case for the SIEM alert SOC173 - Follina 0-Day Detected, on LetsDefend to begin with the Playbook.

Step 0 - Define Threat Indicator:

Click on "Other", and continue to the next step on the Playbook.

Step 1 - Check if the malware is quarantined/cleaned:

Let's verify if the malware is quarantined/cleaned

Log Management
Endpoint Security

We're going to check the date to look for any IOCs, so let's go to the Log Managment.

I'll put here the Event Time that we need to investigate:
Event Time :
Jun, 02, 2022, 03:22 PM

Here is the Log Management and it show us some interesting things, let's have a look:

There is this Ip address that keep repeating in a very short time spam, so it's definitely IOCs, so we take note of this IP for later:

141.105.65.149

Now we go to the Endpoint Security.

Just like before I'll put here the Ip Address and the host name:
Source Address :
172.16.17.39
Hostname :
JonasPRD

It looks like we found something in here:

This shows us some IOCs in the Processes tab:

WINWORD.exe
mstd.exe

Looking at the alert's details in the alert trigger reason give us that the mstd.exe was executed after a Office document, just like in the report from OWASP about the CVE-2022-30190.

And looking a bit further in the Terminal History we see the malware in action:

The second command chain looks very suspicious and dangerous because it is likely involving file extraction, processing and execution.

And for last on this part we take a look on the alert details and the AV (AntiVirus) action (Allowed) doesn't stop the attack.

so we click on Not Quarantined on the Playbook.

Step 2 - Analyze Malware:

Now is the turn to analyze for Malware.

With VirusTotal:

VirusTotal says it is malicious, this is a malicious IP address.

Furthermore, it's seems the malware compromise the host from a phishing email, so we go to the Email Security and search for that email, and we found another IOCs:

We can see the sender is from Rusia and come with an attachment, but don't need to open it, in the alert details is a file hash we can use to see if this attachment is malicious.

File Hash:
52945af1def85b171870b31fa4782e52

Click on Malicious and let's move on.

Step 3 - Check if Someone Requested the C2:

We know the host requested several times the malicious IP address:

The 141.105.65.149

Using AbuseIPDB we can scan the IP address we found in the Log Management:

So click on "Accessed".

Step 4 - Containment:

The host is compromised and is a risk to our organization, we go to Endpoint Security, search for the compromised host and contain it.

Move forward and hit "Next".

Step 5 - Add Artifacts:

Add here the IOCs you found like:

172.16.17.39 Compromised IP
52945af1def85b171870b31fa4782e52 Malicious File
141.105.65.149 C2 IP address

Next.

Step 6 - Analyst Notes:

Here is recommended that you write a summary explaining the nature of the malware, in this case the Follina 0-day exploit, how it was detected and the immediate actions taken, your investigation findings, with all the IOCs that you have found, the containment steps, also the future actions that could be done to prevent or mitigate the risk.

Close the alert and this is True Positive, add your findings and how it was mitigated.

And we have finished this 0-day vulnerability CVE-2022-30190 a.k.a. Follina.

See you next time!

LetsDefend SIEM Alert: Phishing Mail Detected - Internal to Internal - EventID: 52

Jaime Barreto — Sun, 09 Mar 2025 18:09:00 +0000

Hello everyone, today we're going to solve another LetsDefend SIEM alert: Internal to Internal.

Internal to Internal refers to a type of phishing email that was sent from one internal email address to another internal email address. This suggests that either an employee's account has been compromised or it could be the case that the email originated from within the organization's network.

This phishing attack is dangerous because internal emails are trusted more than external ones, making it easier for recipients to open attachments or click on embedded links.

So we have to handle this alert promptly because it is crucial to safeguard our organization's security.

So we start our investigation by creating the case and starting with the playbook:

Parse Email The first step towards our investigation is to obtain information about the incoming email, and the playbook tells us to get the following:

When it was sent?
What is the email's SMTP address?
What is the sender address?
What is the recipient address?
Is the mail content suspicious?
Are there any attachment?

Now we delve into aswering these questions, the first one is in the Event Time:

When it was sent? Feb, 07, 2021, 04:24 AM

Now for the second question that is also in the alert overview:

What is the email's SMTP address? 172.16.20.3

The third question is to know the sender address and is in the Source Address field:

What is the sender address? john@ letsdefend.io

The next is just below next:

What is the recipient address? susie@ letsdefend.io

The fifth question asked us to investigate whether the content of the email is suspicious. Here we go to the Email Security and search for that email using the date, time, the sender, and recipient, like this:

And we click on the corresponding mail:

And know we finally can answer to the last two questions:

Is the mail content suspicious?
Seems like a normal non-suspicious mail from one coworker to another coworker.
Are there any attachment?
No attachment are included in the email.

Now to continue with the Playbook, and click on Next.

The Playbook now asks us if there were any attachments or any URLs in the email.

There were not attachments or any URLs in the email so we click on "No", and continue with the Playbook.

Now lets add some artifacts found:

Source Address:
john@ letsdefend.io

Destination Address:
susie@ letsdefend.io

SMTP Address:
172.16.20.3

Click on Next.

Add any notes in here.

Finish the Playbook by clicking on Confirm.

We have all that we need to close this alert, its a False Positive because there were nothing malicious in the email, no URLs or attachments.

Close the alert and congratulations!, another alert completed!

LetsDefend SIEM Alert: Phising URL Detected - EventID: 86

Jaime Barreto — Tue, 04 Mar 2025 11:25:38 +0000

Hey there,

Here we are going to do a [SIEM] alert, for those who don't know what a [SIEM] is, [SIEM] stands for Security Information and Event Manager, it's a technology -a crucial for modern cybersecurity- that helps organizations to detect, analyze and respond (triage), that aggregate activity from various sources across their entire IT infrastructure. This enables real-time monitoring, analysis, and response to security alerts that are generated by the applications.

We are going to focus on the LetsDefend SIEM simulator, and would looks like this:

Now, let's take ownership of the alert that the [SIEM] has detected: Phishing URL Detected - EventID: 86

The Investigation Channel tab will open and we will see this screen:

Have this info for easy access like a note.

Critical Security Note:
Always exercise caution when handling URL addresses - they may direct to malicious resources.

This information is important to our investigation, so I highly recommend to copy/paste this information, I use free tools to take notes like: Obsidian, Notion, OneNote, even the NotePad is useful.

Then we proceed to [Create Case] below the [Action] in the [Investigation Channel].

Click on [Continue] and proceed.

Now it will show us with the [Incident Details], but we have more details from the previous page, before we continue here we need to open at least two more browser practice tab for making easer and comfortable analysis.

[If you prefer to use one browser tab is ok].

Now we will have a dedicated browser tab for the [Log Management],

and one for the [Endpoint Security].

Now lets click on the [Start Playbook] blue button to start the investigation.

It first dictates to collect data for the investigation, you can see that we already have this info collected even before it was asked!, just take a look on your notes.

The alert info gives the:

Source address: 172.16.17.49
Destination Address: 91.189.114.8
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88

With these data collected, now we proceed, click on [Next].

Now the [Playbook] asked us to search into the [Log Management], we already have this opened, now is the time to look into it.

The [Playbook] does not specify required parameters, but here we are going to use the [Event Time], we can find the [Event Time] in the notes that we already collected.

Event Time:
Mar, 22, 2021, 09:23 PM

We also can change the viewing from [Pro] to [Basic]:

This is just to view more detailed information [Pro], or just the information that we need and be easily readable [Basic].

I'll switch to [Basic] because is more simple, yet useful for me and in this case.

Go now to the blue [Show Filter] button and click on [Select Date] input field.

Put the [Event Time], but first I recommend to change first the year, because if you change it after selecting the month and the day, it will not give you the chance to change the year.

*Note: You can't select just one day, select a day before or a day after.
Example:

Ok, now it will show us this info:

We can see that the [SRC Address] and the [DST Address] are from the ones we are investigating [remember the data collected] and we also see below the [RAW] a magnifying glass with a [+] in it, click on it and lets see what we can find.

Don't close this pop-up, we will need it in the next step.

Now go back to the [Playbook] and click on [Next].

The next step on the [Playbook] is to analyze the URL Address that we have found in our investigation using any of the free services that shown, but I recommend VirusTotal, URLHouse, URLScan and Hybrid Analysis, AnyRun you need a company email to register and to use it.

In this case we are going to use VirusTotal and paste the [URL Address] the seach field on the top of the page and hit [Enter].

We see that the [URL Address] is definitely [Malicious], and now we get back at the [Playbook] and click on the [Malicious] button.

The [Playbook] ask if anyone as accessed the [IP/URL/Domain] to answer the following:

When was it accessed?
What is the source address?
What is the destination address?
Which user tried to access?
What is the User Agent?
is the request blocked?

Now we know where to look, and we go to the [Log Management] again.

Answering these questions:
When was it accessed?
We have the date and the time: Mar, 21, 2021, 09:23 PM

What is the source address?
We see it in the [SRC.ADDRESS] section: 172.16.17.49

What is the destination address?
The same before but below the [DST.ADDRESS] section: 91.189.114.8

Which user tried to access?
To know which user was, we can use the [Endpoint Security] and put the [SRC.ADDRESS] or in our notes under the [Source Address], the user is EmilyComp.

What is the User Agent?
This is also can be found in our notes:
User Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Is the request blocked?
Again we can see this info in our notes under [Device Action]:
Allowed.

Let's head back to the [Playbook] and click on [Accessed].

Now it asked us to [Contain] the infected host machine, under the [Endpoint Security] search for [EmilyComp], and click on [Containment], it changes to [Host Contained].

Now click on [Next] to finish the [Playbook].

Here we can add artifacts of our findings:

Source Address : 172.16.17.49
Destination Address : 91.189.114.8

Request URL : The Malicious Requested URL

Click on [Next] and submit comprehensive case notes, now go to [Next] again.

Finish the [Playbook] by clicking [Confirm] and now we are back to the SIEM Monitoring page where we see our alert, go to [Action] and click on the check mark to [close alert].

Here it ask if this was a [True Positive] or a [False Positive], This was a [True Positive] because the alert correctly identified the security threat.

Well this is the end for this SIEM alert on the LetsDefend page, hope you all find this useful and understandable.

If you have any question you are free to comment!