INCIDENT RESPONSE LABS

What is Incident Response?

Incident Response is a structured approach organizations use to detect, analyze, and respond to cybersecurity incidents and breaches. It includes steps to:

• Preparation
• Identification
• Containment
• Eradication
• Lessons Learned

Benefits of Incident Response:

• Minimizes Damage: A well-executed incident response plan can significantly reduce the impact of a security breach, limiting downtime, data loss, and financial losses.
• Reduces Recovery Time: Having a clear plan and established procedures helps organizations recover from incidents more quickly.
• Enhances Security Posture: Learning from incidents and continuously improving the incident response plan can help organizations strengthen their overall security posture.
• Protects Reputation: Effective incident response can minimize reputational damage associated with security breache

How SOC Analysts Respond to Incidents:

• Monitor logs and alerts (via SIEM)
• Investigate suspicious behavior
• Contain and isolate infected systems
• Coordinate with other teams
• Document and report the incident

Lab Task: Windows Server RDP Brute Force Attack

🧰Lab Setup and Requirements

🖥️Machines Required:

Windows Server 2019 or 2022

• RDP enabled
• Event Viewer access
• One local user account with known username

Kali Linux VM

• Hydra pre-installed
• Connected to same LAN or Virtual Network

📶Network:

• Ensure both machines are on the same network
• Verify RDP (TCP/3389) is open on Windows Server

To verify if RDP (Remote Desktop Protocol) is open on a Windows Server, follow these steps:

Method 1: Check Windows Firewall

1. Open Windows Firewall with Advanced Security.
2. Click on “Inbound Rules” in the left pane.
3. Look for a rule named “Remote Desktop (TCP on port 3389)” or similar.
4. If the rule exists and is enabled, RDP is allowed.

Method 2: Check Port 3389

1. Open Command Prompt as administrator.
2. Run the command: netstat -an | findstr 3389
3. If you see “LISTENING” next to TCP 0.0.0.0:3389, RDP is open.

Method 3: Try Connecting via RDP

1. Open Remote Desktop Connection (mstsc.exe).
2. Enter the server’s IP address or hostname.
3. If you can connect, RDP is open.

If RDP is not open, you can enable it by:

1. Allowing the Remote Desktop (TCP on port 3389) rule in Windows Firewall.
2. Enabling Remote Desktop in System Properties (System > Remote Settings).

⚙️Preparation Steps

On Windows Server:

1. Enable RDP:System Properties → Remote → Enable Remote Desktop
2. Allow RDP in Firewall:Windows Defender Firewall → Advanced Settings → Inbound Rules → Remote Desktop (TCP-In) → Enable
3. Create Test User;net user attackerlab Password123 /add
4. Open Event Viewer: Windows Logs → Security Filter for Event ID 4625 (Failed Logon)

🎯Simulate the Attack

1. On Kali Linux: Install Hydra (if not installed):

sudo apt update && sudo apt install hydra

Prepare Wordlist: Use the existing list or create a custom one, e.g.: /usr/share/wordlists/rockyou.txt 2. Run this command on Kali Linux:

hydra -t 4 -V -f -l attackerlab -P /usr/share/wordlists/rockyou.txt rdp://<Windows_Server_IP>

Replace <Windows_Server_IP> with actual IP of Windows Server

👁️Visualize the Alert in Event Viewer

1. On Windows Server: Open Event Viewer → Windows Logs → Security
2. Look for Event ID 4625 with:

Logon Type: 10 (RemoteInteractive / RDP)

Failure Reason: “Unknown user name or bad password”

Caller IP Address: IP of Kali machine

🚨Incident Response Steps

1. Identify Repeated Failed Logons:

• Spot Event ID 4625 from same IP

2. Correlate IP Address:

• Confirm repeated failures from attacker’s IP

3. Lock the User Account (Optional):

net user attackerlab /active:no

4. Block Attacker IP:

New-NetFirewallRule -DisplayName "Block Attacker" -Direction Inbound -RemoteAddress <Kali_IP> -Action Block

5. Collect Evidence:

• Export relevant Event Logs

6. Report Incident:

• Create a brief report with findings and actions taken