# Sample log excerpts matching the incidents in incidents.txt.
# Bundled for analyst context: after your Sigma rule validates, eyeball these
# lines and ask "would my rule's field matches actually hit this evidence?"
# (These lines are FIXTURE DATA — nothing here is executed. IPs are from the
# RFC 5737 documentation ranges.)

## Incident 1 — credential stuffing (Apache access log)
203.0.113.20 - - [23/Jul/2026:14:02:11 +0000] "POST /account/login HTTP/1.1" 401 231 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64)"
203.0.113.21 - - [23/Jul/2026:14:02:11 +0000] "POST /account/login HTTP/1.1" 401 231 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64)"
203.0.113.22 - - [23/Jul/2026:14:02:12 +0000] "POST /account/login HTTP/1.1" 401 231 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64)"
203.0.113.21 - - [23/Jul/2026:14:09:47 +0000] "POST /account/login HTTP/1.1" 302 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64)"

## Incident 2 — www-data spawning shells (auditd/execve telemetry)
2026-07-23T14:32:04Z audit: EXECVE uid=www-data ppid=20481 parent=/usr/sbin/apache2 exe=/bin/sh args="/bin/sh -c id"
2026-07-23T14:32:09Z audit: EXECVE uid=www-data ppid=20481 parent=/usr/sbin/apache2 exe=/bin/bash args="/bin/bash"
2026-07-23T14:32:15Z audit: EXECVE uid=www-data ppid=20502 parent=/bin/bash exe=/usr/bin/whoami args="whoami"
2026-07-23T14:32:21Z audit: EXECVE uid=www-data ppid=20502 parent=/bin/bash exe=/bin/uname args="uname -a"

## Incident 3 — schtasks persistence (Sysmon Event ID 1, condensed)
2026-07-23T15:01:33Z WKSTN-FIN-07 Sysmon EID1 Image=C:\Windows\System32\schtasks.exe ParentImage=C:\Windows\System32\cmd.exe CommandLine="schtasks /create /sc onlogon /tn \"WindowsUpdateCheck\" /tr C:\Users\finance\AppData\Roaming\updater\svc.exe /f" User=CORP\finance
2026-07-23T15:01:34Z WKSTN-FIN-07 Sysmon EID1 Image=C:\Users\finance\AppData\Roaming\updater\svc.exe ParentImage=C:\Windows\System32\svchost.exe CommandLine="C:\Users\finance\AppData\Roaming\updater\svc.exe" User=CORP\finance
