InsideOut

☠️

[InsideOut @Inside04Outer]

into /root (e.g., via compromised SSH session or sudo escalation)

[InsideOut @Inside04Outer]

WAZUH & VIRUS TOTAL INTEGRATION

Scenario: Unauthorized Malware Drop on a Privileged Linux Server Organization

#Cybersecurityjourney #TsAcademy #Cybersecurity

[InsideOut @Inside04Outer]

Review Wazuh Dashboard / Alerts: Check /var/ossec/logs/alerts/alerts.log to confirm no additional unauthorized files or modified binaries exist in privileged directories

Audit User Activity: Inspect Linux system auth logs (/var/log/auth.log) to determine how the file was dropped

[InsideOut @Inside04Outer]

Final Review -

Overall Severity: HIGH !

Likely objective: credential theft/account takeover.

[InsideOut @Inside04Outer]

SOC Investigation –Phishing Email

1. Indicators of Compromise (IOCs):

Sender: info@libreriacies[.]es

Sender domain: libreriacies[.]es

URL: hxxps://tinyurl[.]com/ypu5kfts

Recipient:
sonyundefinedralph@gmail[.]com

@TSAcademy #tsacademy #cybersecurity #cybersecurityjourney

[InsideOut @Inside04Outer]

5. Phishing Determination:

YES – this is a phishing incident. The email uses Microsoft impersonation, a suspicious sender domain, a shortened URL, urgency, and an account-security lure to trick the recipient into verifying their identity.

[InsideOut @Inside04Outer]

4. URL Analysis:

https://t.co/3900980Y7i is suspicious because it hides the true destination and does not use a Microsoft domain. It should not be clicked. Threat-intelligence analysis has associated the URL with phishing activity.