jhatchi/nexacorp-dfir-inc-2026-001DFIR investigation + 7 Suricata rules on a simulated NexaCorp intrusion (vsftpd 2.3.4 CVE-2011-2523 + MITRE Caldera C2). 4-day solo engagement (BeCode Brussels Mission 01). 54-page report, 10 findings, 7/7 rules validated by PCAP replay.
DFIR investigation and detection engineering on a simulated intrusion against NexaCorp infrastructure. Conducted as a 4-day solo engagement (BeCode Brussels Blue & Red Team bootcamp, Mission 01). The deliverable is a 54-page findings report (PDF) plus 7 validated Suricata rules that catch the captured incident in PCAP replay.
This repository documents a SOC analyst engagement carried out as part of the BeCode Cybersecurity Bootcamp (promotion 2025-2026). It reconstructs a full intrusion from network and log evidence, then delivers a validated set of Suricata detection rules. It is the first incident in the NexaCorp DFIR series.
This is a lab engagement against fictitious infrastructure. NexaCorp is a fictional client used as the scenario for BeCode Brussels Mission 01. The compromised host is a Metasploitable 2 VM intentionally vulnerable for security training, and the Caldera Sandcat implant is part of the lab teaching the analyst what a real intruder's beacon traffic looks like. No real organization, network, or human was attacked.
All IP addresses, hostnames, and indicators of compromise published in this report (172.16.50.10, 192.168.10.10, 10.40.0.200, blue11, mesdec, etc.) are lab-local artifacts, not real-world threat intelligence. Do not feed them to a SIEM as IOCs.
Publication authorized by BeCode lab coach (Thomas B.) on 2026-05-17. The full Confidentiality Statement appears in the findings report (section "Distribution and Classification").
| Engagement metadata | Value |
|---|---|
| Reference | BCC-2026 / INC-2026-001 |
| Duration | 4 days (solo) |
| Phases | DFIR (forensic) + detection engineering |
| Delivered | 2026-05-15 |
| Status | Complete (Phase 1 + Phase 2) |
| Investigation output | Value |
|---|---|
| Findings | 10 (3 CRITICAL, 3 HIGH, 2 MEDIUM, 2 LOW) |
| MITRE ATT&CK techniques mapped | 14 |
| Network capture analyzed | 5,194 packets over 5h31m (943 KB PCAP) |
| Wazuh events correlated | 397 from agent 020 |
| Suricata rules authored | 7 (SID 9000001-9000007) |
| Rules validated by PCAP replay | 7/7 (40 fast.log alerts, 314 eve.json records) |
Scenario (fictional). NexaCorp, a mid-sized corporate client, contacted BeCode Corp's blue team after their internal monitoring flagged unexpected outbound traffic from one of their internal Linux servers. Their firewall logged the traffic but raised no actionable alert. The board needed a determination before deciding on disclosure and regulatory notification.
Mandate. Investigate the suspected incident window, characterize the attacker's path of entry and post-exploitation activity, assess what the existing detection stack caught (and missed), and deliver a prioritized remediation plan. A second phase added detection engineering: produce ready-to-deploy network IDS rules that would catch a recurrence in real time.
Evidence package received from the client.
| Artefact | Coverage | Note |
|---|---|---|
| Network capture (PCAP) | 2026-05-09 20:08 to 2026-05-10 01:39 UTC (5h31m, 5,194 packets) | Starts mid-incident: implant already beaconing in frame 1 |
| Host authentication log | 2026-05-10 06:47 UTC onward | Post-incident only (gap of ~5 hours after PCAP ends) |
| Host syslog | 2026-05-10 06:37 UTC onward | First entry is syslogd restart, suggests VM reboot |
| SIEM alerts export (Wazuh) | n/a | File was an HTTP 404 response, not data. Recovered 397 events later via direct dashboard query |
Educational context. This engagement was delivered during the BeCode Brussels Blue & Red Team bootcamp (November 2025 to September 2026) as Mission 01: a solo, time-boxed investigation simulating a real DFIR consulting engagement. The lab infrastructure, NexaCorp identity, and IOC values are deliberately fictional. The methodology, tools, and report format follow real-world standards (NIST SP 800-61r2, SANS PICERL, MITRE ATT&CK).
📄 The full 54-page findings report is the canonical deliverable. Download the PDF (215 KB) or browse the Markdown source for grep/citation.
On the evening of 2026-05-09 at 22:53 UTC, an external attacker (172.16.50.10) compromised a NexaCorp internal server (192.168.10.10) by exploiting CVE-2011-2523, the backdoor present in vsftpd 2.3.4 (a build that has been publicly documented as compromised since July 2011). A single FTP USER request ending with :) triggered an unauthenticated root bind shell on TCP/6200. The attacker ran 8 reconnaissance commands over a 20-second session (no persistence, no exfiltration, no lateral movement via this access vector) and disconnected.
Independently, the same host was found to be running a pre-existing MITRE Caldera "Sandcat" agent at /opt/caldera/sandcat (root, daemonized) beaconing every 40-50 seconds in cleartext HTTP to 10.40.0.200:8888 throughout the captured window. This is the "unusual outbound connection" originally flagged by the client and indicates a prior compromise not represented in the evidence package (the implant was already active in the first PCAP frame).
The existing Wazuh SIEM ingested 397 events from the target host but raised only 4 high-severity alerts (1.0% of total), all classified as generic brute-force (MITRE T1110). None identified the CVE-2011-2523 exploit payload, the bind shell on TCP/6200, or the Caldera C2 channel: the exploit byte (USER baduser:)) is never logged by vsftpd itself, and the SIEM had no network telemetry to see the rest. The 7 Suricata rules delivered in Phase 2 close all three gaps.
Headline IOCs (lab-bound, do not feed to a real SIEM):
| Type | Value | Context |
|---|---|---|
| Source IP (attacker) | 172.16.50.10 | vsftpd exploit, multi-protocol recon, SSH brute-force |
| Target IP | 192.168.10.10 | Compromised internal server (Metasploitable 2) |
| C2 IP | 10.40.0.200:8888 | Caldera Sandcat command-and-control |
| Backdoor port | 6200/tcp | CVE-2011-2523 root bind shell |
| Exploit payload | FTP USER ending with :) | Backdoor trigger pattern |
