# Incident descriptions for Day-4 Sigma rule generation demo.
# Each section is prefixed with "# Incident N" — used as a delimiter.
# The LLM generates a Sigma rule for each incident, then sigma-cli validates it.

# Incident 1: SSH Brute Force with Successful Login

Analysts observed repeated SSH authentication failures from external IP 203.0.113.42 targeting
multiple usernames (admin, root, ubuntu, oracle) on the public-facing jump server (10.0.0.5).
Over 450 authentication failures were recorded in a 3-minute window between 02:14 and 02:17 UTC.
Two successful authentications followed shortly after for the 'deploy' user account.
Source IP has no prior legitimate access history. Port 22 was the only target port.

Detection goal: Alert when 10 or more SSH authentication failures occur from the same source IP
within 5 minutes, especially when followed by a successful authentication from the same source.

# Incident 2: Webshell Upload via PHP File Upload Vulnerability

An attacker exploited a file upload endpoint (/upload.php) on the company web application running
Apache 2.4 on Ubuntu. A PHP webshell (shell.php) was uploaded to /uploads/. Within 2 minutes,
the attacker began issuing OS commands via the webshell (?cmd=id, ?cmd=whoami). The source IP was
198.51.100.7. Apache access logs show POST requests to /upload.php followed immediately by GET
requests to /uploads/shell.php with a 'cmd' query parameter. The HTTP response size for the
command execution requests was unusually small (under 50 bytes), consistent with command output.

Detection goal: Detect web server access to .php files in directories typically used for user
uploads (uploads/, files/, attachments/) with a 'cmd' query parameter in the URI.

# Incident 3: PowerShell Encoded Command Execution via Office Macro

A Windows workstation (hostname: WKSTN-ALICE-42) executed PowerShell with a base64-encoded
command string. Process creation monitoring shows: WINWORD.EXE spawned cmd.exe, which spawned
powershell.exe with the argument '-EncodedCommand [base64 string]'. This pattern is characteristic
of a malicious VBA macro in a Word document. The PowerShell process was observed making an
outbound HTTP connection to 198.51.100.99 on port 80 within seconds of execution.

Detection goal: Detect PowerShell execution with encoded command arguments (-EncodedCommand or -enc)
when the parent process is a Microsoft Office application (WINWORD.EXE, EXCEL.EXE, POWERPNT.EXE).
