A chronological account of the BOTSv3 security incident on 20 August 2018, categorised by MITRE ATT&CK tactics, from initial access and phishing through to exfiltration and a Memcached DDoS attack.
Marco Cavani
Cybersecurity Analyst
The Boss of The SOC (BOTS) V3 timeline offers a chronological account of security events that occurred on 20 August 2018, between 0900 and 1600. The timeline categorises events according to the MITRE ATT&CK framework, a widely used framework for analysing adversarial tactics and techniques.
AKIAJOGCDXJ5NW5PXUPA/web_admin attempts to access IAM resources.web_admin attempts to create nullweb_admin.web_admin attempts to launch a Xenial Xerus instance.AKIAJOGCDXJ5NW5PXUPA/web_admin credentials were detected on GitHub.Frothly-Brewery-Financial-Planning-FY2019-Draft.xlsm delivered via phishing.HxTsr.exe launched from the malicious attachment.HxTsr.exe.stout.png, stout-2.png, morebeer.jpg uploaded to OneDrive.BRUCE BIRTHDAY HAPPY HOUR PICS.lnk uploaded to OneDrive.hdoor.exe scans the network.logos.png downloaded from 45.77.53.176:3333."cromdale OR beer OR financial OR secret".iexeplorer.exe (CVE-2017-9791)."colonel" streamed using iexeplorer.exe."definitelydontinvestigatethisfile.sh" streamed using iexeplorer.exe.iexeplorer.exe (CVE-2017-9791).tomcat8 runs ./colonelnew, achieving privilege escalation to root (CVE-2017-16995).tomcat7 Linux account created.root runs rm /usr/share/tomcat8/.bash_history.netcat listening on port 1337 starts.netcat on port 1337 ends.hyunki1984@naver.com added.frothlywebcode S3 bucket made public.OPEN_BUCKET_PLEASE_FIX.txt uploaded to frothlywebcode.frothly_html_memcached.tar.gz uploaded to frothlywebcode.One particular incident that provided valuable insights was the Memcached attack. It emphasised the importance of securing and properly configuring Memcached instances to prevent unauthorized access and abuse.
This incident highlighted the need for:
This timeline provides an overview of events categorised by their respective MITRE ATT&CK phases, aiding in incident response and strengthening defence strategies.
Written by
Marco Cavani
Cybersecurity analyst and IT governance professional. Author of digital reports on threat intelligence, critical infrastructure security, and IT audit frameworks.
A strategic deep-dive into NIST's Computer Security Incident Handling Guide, covering the full IR lifecycle, team structure, detection methods, prioritisation frameworks, and the power of post-incident learning.
In 2016, attackers accessed Uber's GitHub, found AWS credentials in plain text, and downloaded 57 million user records. The entire attack was detectable. The signals existed. No system was watching and correlating them. That is what a SIEM is for.
Key insights from IBM's Cost of a Data Breach report: healthcare leads at $10.1M per breach, while AI platforms, DevSecOps, and incident response teams can significantly cut costs.
Get the latest cybersecurity reports, threat intelligence, and IT governance insights delivered straight to your inbox. No spam. Unsubscribe any time.
No spam. Unsubscribe at any time.
The RACM ITGC SaaS platform helps audit professionals manage IT General Controls assessments, from risk and control mapping to workpaper generation and evidence tracking.