# Incident descriptions for the Day-4 detection-engineering lab (Exercise A: Sigma).
# Each section is prefixed with "# Incident N" — used as a delimiter.
# The LLM generates a Sigma rule for each incident, then sigma-cli validates it.
# These are DIFFERENT incidents from the day4-mcp-secops lab so the two labs
# can be run back-to-back without repeating rules.

# Incident 1: Credential Stuffing Against the Web Login Endpoint

The web team reported a spike in failed logins on the customer portal (Apache 2.4,
Ubuntu 22.04). Access logs show over 3,000 POST requests to /account/login within
20 minutes, cycling through hundreds of distinct usernames from a small set of
source IPs (203.0.113.20, 203.0.113.21, 203.0.113.22). Nearly all requests returned
HTTP 401. Three requests from 203.0.113.21 returned HTTP 302 (successful login
redirect), suggesting valid credential pairs from a breached-password list were found.
The User-Agent header was identical across all requests.

Detection goal: Alert on a high volume of POST requests to the login endpoint that
receive 401 responses, particularly when a 302 success follows from the same source.

# Incident 2: Web Server Account Spawning Interactive Shells

Endpoint telemetry on the DMZ web server (Ubuntu, Apache running as www-data) shows
the www-data account spawning interactive shells: apache2 spawned /bin/sh -c with
piped commands, followed by /bin/bash and id/whoami/uname invocations. The www-data
service account has no legitimate reason to launch interactive shells — this pattern
is consistent with a webshell or a successful RCE exploit against the web application.
Activity began at 14:32 UTC and originated from worker process PID 20481.

Detection goal: Detect process creation events where the parent is a web server
process (apache2, nginx, httpd) or the user is a web service account (www-data),
and the child process is a shell (/bin/sh, /bin/bash, /bin/dash).

# Incident 3: Scheduled Task Persistence via schtasks.exe

A Windows finance workstation (hostname: WKSTN-FIN-07) created a suspicious scheduled
task minutes after a phishing attachment was opened. Process creation logs show
schtasks.exe launched with '/create /sc onlogon /tn "WindowsUpdateCheck" /tr' pointing
at an executable in the user's AppData\Roaming directory. The task name imitates a
legitimate Windows component, and the run target is not a signed Microsoft binary.
Creating logon-triggered scheduled tasks from user-writable paths is a classic
persistence technique (MITRE ATT&CK T1053.005).

Detection goal: Detect schtasks.exe process creation with a /create argument where
the task run target (/tr) points into AppData, Temp, or another user-writable path.
