Unit 1: Who attacks and how · Lesson 4 of 4 · 24 min

From advisory to checks

Pull the indicators out of a sector advisory and search Northwind's logs for every one.

mission

You are: The analyst who owns threat intel this week.
Situation: The freight sector ISAC published advisory FL-2026-117 yesterday. It lists domains and IP addresses used by a crew attacking companies like Northwind.
Goal: Turn the advisory into a list of indicators, search the mail and proxy logs for each and record every hit.
Hand in: A list of the indicators that matched, with who and when.

Read the advisory

Read the summary and techniques first. They tell you what kind of hit to expect: phishing, fake portals, payment fraud.

analyst@soc-lab

analyst@soc-lab:~/cases/advisory$ cat advisory-2026-10.txt
Freight and Logistics ISAC
Advisory FL-2026-117, issued 2026-10-12, TLP:GREEN

Summary
A financially motivated crew is targeting freight companies with
password-expiry phishing, supplier bank-change requests and fake
parcel-tracking pages. Several members reported invoice fraud
attempts in the last two weeks.

Techniques seen
  initial-access      phishing links to lookalike login pages
  credential-access   passwords collected on fake portals
  persistence         mailbox rules that forward invoices outside
  impact              payment redirection to new bank accounts

Indicators
  domain  northwlnd.example
  domain  northwind-portal.example.net
  domain  harbour-supplies.example
  domain  parcel-track.example.net
  domain  cdn-update.example.net
  ip      203.0.113.17
  ip      203.0.113.140
  ip      198.51.100.61

Recommended checks
  1 search mail and proxy logs for the indicators above
  2 review mailbox forwarding rules created in the last 30 days
  3 confirm any bank-change request by phone, using known numbers

Extract the indicators

Copying indicators by hand causes typos. Let awk pull them out and save them to a file you can reuse.

analyst@soc-lab

analyst@soc-lab:~/cases/advisory$ awk '$1=="domain" {print $2}' advisory-2026-10.txt > domains.txt
analyst@soc-lab:~/cases/advisory$ awk '$1=="ip" {print $2}' advisory-2026-10.txt > ips.txt
analyst@soc-lab:~/cases/advisory$ cat domains.txt ips.txt
northwlnd.example
northwind-portal.example.net
harbour-supplies.example
parcel-track.example.net
cdn-update.example.net
203.0.113.17
203.0.113.140
198.51.100.61

you should see Five domains and three IP addresses, one per line.

Search the proxy log

grep -F -f reads every line of a file as a fixed string to look for. One command checks all five domains.

analyst@soc-lab

analyst@soc-lab:~/cases/advisory$ grep -F -f domains.txt /var/log/proxy/access.log
2026-10-13T08:47:12Z 10.10.0.63 m.bianchi GET https://northwind-portal.example.net/login 200 2194
2026-10-13T08:52:31Z 10.10.0.41 j.ortiz GET https://northwind-portal.example.net/login 200 3785
2026-10-13T08:53:05Z 10.10.0.41 j.ortiz POST https://northwind-portal.example.net/login 302 2173
2026-10-13T08:53:06Z 10.10.0.41 j.ortiz GET https://northwind-portal.example.net/done 200 3424
2026-10-13T09:15:40Z 10.10.0.71 a.rahman GET https://northwind-portal.example.net/login 200 1173
2026-10-13T14:22:08Z 10.10.0.95 t.nguyen GET https://parcel-track.example.net/track?id=NW88213 200 1238

you should see Five hits from this morning's password phishing, and one more nobody has reported: a parcel-tracking page.

defender tip Use -F for indicators. Without it the dots in a domain are regex wildcards and match things they should not.

Search the mail log and count

Mail hits tell you who received something. Count first, then read.

analyst@soc-lab

analyst@soc-lab:~/cases/advisory$ grep -c -F -f domains.txt /var/log/mail/mail.log
8
analyst@soc-lab:~/cases/advisory$ grep -F -f domains.txt /var/log/mail/mail.log | grep -o 'from=<[^>]*>' | sort | uniq -c
      2 from=<accounts@harbour-supplies.example>
      6 from=<it-support@northwlnd.example>

Check the IP addresses

IPs from an advisory are often infrastructure that changes daily. A miss today is still worth recording.

analyst@soc-lab

analyst@soc-lab:~/cases/advisory$ grep -c -F -f ips.txt /var/log/proxy/access.log
0

you should see 0. None of the advisory IPs appear in today's proxy log.

defender tip Record misses too. 'Searched, nothing found, on this date' is a finding a later analyst can rely on.

What a defender takes away

1Extract indicators with a command, never by retyping them.
2grep -F -f file searches for a whole list at once.
3One unexplained hit, like the parcel-tracking page, is worth more than the hits you already knew about.

Questions

0 of 3 solved

Answer each one from what you find on your lab machine.

1Which advisory domain appears in the proxy log but was not part of the password phishing?
Show hint
Search the proxy log with domains.txt and look for the odd one out.
2Which user visited it?
Show hint
The third field of a proxy line is the user.
3How many mail log lines match an advisory domain?
Show hint
grep -c with the domains file against /var/log/mail/mail.log.