Dashboard
Incidents by Sector
Detailed breakdown of incidents across different sectors. Select one to learn more.
Dark Web Intelligence
Simulated chatter from dark web marketplaces regarding the breach.
> Fresh dump: Queen Elizabeth Central Hospital (Malawi) patient records. 50k+ entries. Full names, DOB, medical history. Perfect for identity theft. DM for sample.
> Selling exclusive access to Malawi hospital database. Contains PII and sensitive health info. Auction starts at 10 BTC.
> Just acquired a large dataset from a Malawian hospital breach. Includes records of government officials. High value.
IOC to Log Correlation Exercise
Select an IOC to see how it appears in the network logs and understand its significance.
Relevant Network Logs
| Timestamp | Source IP | Destination IP | Protocol | Length | Info | Threat Type |
|---|---|---|---|---|---|---|
| 10.10.150.82 | 185.220.101.35 | HTTPS | 2104 | TLSv1.3 Handshake, SNI: university-login.portal-mal.com | Initial Access | |
| 185.220.101.35 | 10.10.150.82 | TCP | 980 | HTTP POST /login with user credentials (charlie.dean) | ||
| 198.51.100.23 | 172.16.1.15 | RDP | 1500 | RDP Connection Request to RTD-APP-01 | Lateral Movement | |
| 172.16.1.15 | 198.51.100.23 | TCP | 180 | SMB2 Create Request, File: \\172.16.1.15\C$\Windows\Temp\payload.dll | Lateral Movement | |
| 172.16.1.15 | 198.51.100.23 | DNS | 78 | Standard query 0x1234 A IN c2.lockbit.internal | C2 Beacon | |
| 172.16.1.15 | 198.51.100.23 | HTTPS | 256 | Encrypted C2 Beacon | C2 Beacon | |
| 172.16.1.15 | 172.16.1.20 | SMB | 2048 | SMB Enumeration of shares on RTD-DB-01 | Reconnaissance | |
| 172.16.1.15 | 172.16.1.20 | TCP | 102 | Ransomware key exchange | C2 Beacon | |
| 10.10.150.82 | 172.18.1.10 | Kerberos | 312 | AS-REQ, User: qeh_admin@qech.med.mw | Lateral Movement | |
| 10.10.150.82 | 172.18.1.10 | DCERPC | 250 | NetrServerReqChallenge (Zerologon attempt) | Lateral Movement | |
| 10.10.150.82 | 172.18.5.21 | ICMP | 64 | Ping to EHR-DB-02 | Reconnaissance | |
| 198.51.100.23 | 192.168.100.10 | S7COMM | 112 | S7 Communication: Stop CPU command | Command & Control | |
| 192.168.100.10 | 198.51.100.23 | TCP | 74 | C2 Beacon from PLC | C2 Beacon | |
| 172.18.5.21 | 8.8.8.8 | DNS | 82 | Standard query 0x5678 A IN pastebin.com | Reconnaissance | |
| 172.18.5.21 | 198.51.100.23 | HTTPS | 1500 | TLSv1.3, large packet size, potential data staging | Data Exfiltration | |
| 172.18.5.21 | 198.51.100.23 | HTTPS | 1048576 | Continuous large data upload to C2 server | Data Exfiltration | |
| 104.26.10.188 | 192.0.2.100 | HTTP | 750 | HTTP POST /node/add (Drupal CMS) | Command & Control | |
| 203.0.113.88 | 10.100.1.5 | SIP | 650 | SIP INVITE (Initiating deepfake video call) | Initial Access | |
| 10.10.150.82 | 172.18.1.10 | DCERPC | 128 | SAMR Query, EnumUsers | Reconnaissance | |
| 198.51.100.23 | 172.18.1.10 | LDAP | 210 | LDAP searchRequest, filter=(userPrincipalName=charlie.dean) | Reconnaissance | |
| 172.16.1.15 | 172.16.1.20 | SMB | 4096 | SMB Write Request, file: \\RTD-DB-01\C$\...\README.lockbit | Command & Control | |
| 172.16.1.15 | 198.51.100.23 | HTTPS | 310 | C2 Beacon: Encryption complete on RTD-APP-01 | C2 Beacon | |
| 192.168.100.5 | 192.168.100.10 | S7COMM | 120 | S7 Communication: Write Variable (manipulating setpoint) | Command & Control | |
| 172.18.5.21 | 198.51.100.23 | HTTPS | 2097152 | Sustained data upload, total >1GB | Data Exfiltration | |
| 104.26.10.188 | 192.0.2.100 | HTTP | 1204 | HTTP POST /admin/config/media/file-system (Drupal file upload) | Command & Control | |
| 10.10.150.82 | 172.17.20.5 | SMB | 512 | Accessing share \\UNI-FILE-SVR\research$ | Lateral Movement | |
| 172.16.1.15 | 172.16.1.1 | DCERPC | 188 | SAMR query against RTD Domain Controller | Reconnaissance | |
| 198.51.100.23 | 192.168.100.10 | S7COMM | 98 | S7 Communication: Read Variable (verifying manipulation) | Reconnaissance | |
| 198.51.100.23 | 172.17.20.5 | SMB2 | 2048 | Accessing file \\UNI-FILE-SVR\research$\ProjectX.zip | Lateral Movement | |
| 172.16.1.15 | 198.51.100.23 | HTTPS | 1024 | C2 Heartbeat, sending ransomware status | C2 Beacon |
Phishing Attack Simulator
Generate a sample phishing email based on the current scenario.