Expert 3: Full Incident Response Simulation - Multi-Stage Investigation

Target Skill: Melakukan incident response lengkap: detection, containment, eradication, recovery, dan lessons learned
Tools: Semua tools dari beginner + intermediate + expert

Skenario

Kasus: Sebuah perusahaan e-commerce (PT. Toko Online) mendeteksi anomali - data pelanggan 50.000 record bocor. Tim IT melakukan memory capture, disk imaging, dan network capture.

Tugas: Lakukan IR lengkap dengan tools yang sudah dipelajari.

cd ~ && mkdir forensics-exp3 && cd forensics-exp3

# Simulasi IR Report
cat << 'IRREPORT'
═══════════════════════════════════════
  INCIDENT RESPONSE REPORT
  PT. Toko Online
  Tanggal: 18 Juni 2026
═══════════════════════════════════════

1. DETECTION (08:00 - 08:30)
   • Monitoring SIEM mendeteksi data transfer 500MB ke IP 203.0.113.5
   • Anomali: Transfer jam 02:00 AM dari server database
   • Alert: Event ID 1102 (log cleared)

2. CONTAINMENT (08:30 - 09:00)
   • Isolasi server database dari jaringan (firewall drop)
   • Capture memory & disk image (forensic preservation)
   • Reset semua credentials (user + database)
   • Nonaktifkan remote access

3. ERADICATION (09:00 - 10:30)
   • Analisis memory dengan Volatility 3:
     - Deteksi hidden process (PID 1337)
     - C2 connection ke 203.0.113.5:443
     - Malware di C:\Windows\Tasks\svchost.exe
   • Analisis disk: file exfil ditemukan di /tmp/.cache/
   • Network: DNS tunneling ke malware-c2.com
   • Hapus malware + rootkit persistence

4. RECOVERY (10:30 - 12:00)
   • Restore database dari backup (sebelum insiden)
   • Patch vulnerability: SQL Injection di login page
   • Implementasi WAF (Web Application Firewall)
   • Enable extended logging + centralized SIEM

5. LESSONS LEARNED
   Root Cause: SQL Injection di endpoint /api/login
   Timeline: Attacker exploit → SQLi → get shell → install rootkit → exfil data
   Total Data Loss: 50,000 customer records (name, email, phone, address)
   No financial data exposed (kartu kredit terenkripsi)
   
   Recommendations:
   [1] Implement prepared statements (no raw SQL queries)
   [2] Enable binary logging + ship to remote SIEM
   [3] Regular VAPT (Vulnerability Assessment & Penetration Testing)
   [4] Security awareness training untuk developer
   [5] Incident response drill (quarterly)
IRREPORT

IR Proses Lengkap

Fase	Aktivitas	Tools
Detection	SIEM alert, IDS signature, anomaly detection	Wazuh, Suricata, custom SIEM
Containment	Isolasi network, firewall drop, credential rotation	iptables, nftables
Eradication	Volatility analysis, disk forensics, malware removal	volatility3, TSK, AV scanner
Recovery	Restore backup, patch vuln, implement WAF	rsync, git, mod_security
Post-mortem	Root cause, timeline, recommendation	-

Refleksi: IR bukan hanya teknis - ini adalah proses bisnis. Setiap detik downtime berarti kerugian. Kecepatan respon (dalam menit, bukan jam) adalah KPI utama. Latihan IR dril rutin adalah investasi terbaik.

Generated by @farishhz Agent Pentest Pipeline - TDCTF Security Academy