Investigating External Threats
An attacker may gain initial access to the target environment by exploiting one of the published web applications or by using valid credentials such as an RDP, VPN, mailbox, and web services credentials. After successful exploitation, the threat actor will have the opportunity to control the whole environment and achieve their objectives, such as disrupting the digital life, espionage, or exfiltrating the data. As an SOC analyst, you should be aware of this and take advantage of the logs provided by the Web Application Firewall (WAF), firewalls, IPS logs, and custom applications logs to investigate such threats.
The objective of this chapter is to learn about some of the most common web attacks, such as code injection, SQL injection, path traversal, and cross-site scripting attacks, and how to investigate web application threats by analyzing the WAF logs. We will also learn how to detect and investigate suspicious external access to remote services...
