Misconfiguration Hunt & Fix

An attacker used SSH brute force to compromise the root account, then successfully uploaded a web shell (shell.php) to the web server. Neither attack triggered any IDS alert, and a subsequent reverse shell connection was also undetected.

The security team had previously disabled several signatures to "reduce false positives." Additionally, the IDS is running in detection-only mode — even when traffic is detected, it is not blocked.

An employee's corporate communications were intercepted while using VPN over public Wi-Fi at a coffee shop. Additionally, a former employee used leaked credentials to gain unauthorized VPN access.

Investigation revealed the VPN was configured with a legacy protocol for "Windows XP compatibility," a shared pre-shared key still known to ex-employees, and internet traffic was leaking outside the VPN tunnel.

The service was completely unavailable for 2 hours. The attacker simultaneously launched a SYN Flood (exhausting the TCP connection table) and an HTTP Flood (overwhelming the application layer).

The ops team had disabled SYN Cookie because "it added 5ms of latency," and turned off L7 HTTP protection and CAPTCHA to "improve mobile user experience." The configured rate-limit threshold was also far too high to be effective.

An attacker operated undetected inside the internal network for 3 weeks. The full kill chain — reconnaissance → initial access → C2 communication → data exfiltration — generated zero SIEM alerts.

Post-incident analysis revealed the SOC team had disabled Brute Force Detection (CR-001), APT Kill Chain Detection (CR-006), and Account Takeover Detection (CR-008) due to "alert fatigue." Each stage was logged, but no correlation alert was ever raised.