Pashupatastra

INC-2026-0903

criticalescalatedopened 11d ago

Affected assets: file-share, app-07
Accounts affected: 0
Stated confidence: 86% stated

A confidence the scenario's author stated when writing it — not a measured rate. Nothing here has yet been scored against a human's later verdict; calibration arrives when outcomes exist (R96), and until then no figure is invented for it.

Causal chain

ws-0148->198[.]51[.]100[.]74:8443
outbound every 60s ± 2s to a destination never seen before
evidence: SEC-0003-a, SEC-0003-b
technique: T1071.001 Web Protocols · Command and Control
ws-0148
SMB opened to two hosts never previously contacted

Diagnosis

ws-0148 is beaconing to a command-and-control host and has begun moving laterally: new SMB peers, then a scheduled task.

evidence: SEC-0003-a, SEC-0003-b, SEC-0003-c, SEC-0003-d

Also considered

A backup agent is running on its schedule.9% stated
contradicted by: SEC-0003-e, SEC-0003-c, SEC-0003-d

Shown because a system that hides its own doubt is harder to trust than one that reports it.

Remediation plan

execution requires a policy verdict

01isolate_hostrisk 55expects network isolated, edr reachablerollback: rejoin_network
02block_iprisk 35expects traffic_from_ip deniedrollback: unblock_ip

Risk shown is the action’s base score. Effective risk rises with blast radius, production environment, and low confidence — it never falls, and the dashboard never computes it here.

Timeline

11d agoagent:sentinelcorrelatedbeacon, new SMB peers and remote task creation on one host within 90 minutes
11d agoagent:analystdiagnoseddestination absent from backup inventory — the backup reading does not hold
11d agodharmaescalatedisolate_host scores 55 → senior approval

Sigma field	Read from	Value	Evidence
DestinationPortthis incident only	entity_ref.id	8443	SEC-0003-a, SEC-0003-b
DestinationIpthis incident only	entity_ref.id	198.51.100.74	SEC-0003-a

Sigma field

Read from

Value

Evidence

DestinationPortthis incident only

entity_ref.id

8443

SEC-0003-a, SEC-0003-b

DestinationIpthis incident only

entity_ref.id

198.51.100.74

SEC-0003-a

Sigma field	Read from	Value	Evidence
Computerthis incident only	entity_ref.id	ws-0148	SEC-0003-c

Sigma field

Read from

Value

Evidence

Computerthis incident only

entity_ref.id

ws-0148

SEC-0003-c

Sigma field	Read from	Value	Evidence
Image	entity_ref.id	schtasks	SEC-0003-d

Sigma field

Read from

Value

Evidence

Image

entity_ref.id

schtasks

SEC-0003-d

# DRAFT - assembled from one incident's stored telemetry. Not deployed, # not validated against a live log pipeline, and not adopted. # Incident: INC-2026-0903 # Technique: T1071.001 Web Protocols (Command and Control) # # Every field below was read from a stored event: # DestinationPort <- entity_ref.id (matches this incident only); SEC-0003-a, SEC-0003-b # DestinationIp <- entity_ref.id (matches this incident only); SEC-0003-a, SEC-0003-b # SourceHostname <- entity_ref.id (matches this incident only); SEC-0003-a, SEC-0003-b # # This telemetry could not supply, and a reviewer should add: # Image - no stored event for this step carries Image; the normalized event model (events.py) has no field it maps from, so a rule for T1071.001 keying on it would be inventing the value # User - no stored event for this step carries User; the normalized event model (events.py) has no field it maps from, so a rule for T1071.001 keying on it would be inventing the value # # WARNING: every field is an instance value. This matches this incident and not the technique. title: 'Draft: Web Protocols observed in INC-2026-0903' id: 6b199822-5ab5-5b3a-b00c-a45e83b12d0a status: experimental description: 'Drafted from INC-2026-0903, which recorded: outbound every 60s ± 2s to a destination never seen before. Fields below were read from SEC-0003-a, SEC-0003-b. Some fields this technique usually keys on are absent - see x-gaps.' references: - INC-2026-0903 - SEC-0003-a - SEC-0003-b author: Sati (drafted from one incident; not validated against live telemetry) date: 2026/10/18 tags: - attack.command_and_control - attack.t1071.001 logsource: category: security product: pashupatastra service: demo detection: selection: DestinationPort: 8443 DestinationIp: 198.51.100.74 SourceHostname: ws-0148 condition: selection falsepositives: - Every field is specific to INC-2026-0903 (DestinationPort=8443, DestinationIp=198.51.100.74, SourceHostname=ws-0148). This will match unrelated activity on the same entities and nothing elsewhere. level: high x-provenance: DestinationPort: source_field: entity_ref.id observed_in: - SEC-0003-a - SEC-0003-b generalises: false DestinationIp: source_field: entity_ref.id observed_in: - SEC-0003-a - SEC-0003-b generalises: false SourceHostname: source_field: entity_ref.id observed_in: - SEC-0003-a - SEC-0003-b generalises: false x-gaps: Image: no stored event for this step carries Image; the normalized event model (events.py) has no field it maps from, so a rule for T1071.001 keying on it would be inventing the value User: no stored event for this step carries User; the normalized event model (events.py) has no field it maps from, so a rule for T1071.001 keying on it would be inventing the value x-not-mapped: SubjectUserName: 'payload.principal on SEC-0003-b is ''ws-0148->198.51.100.74:8443'', which is a network_flow and not an account. Mapping it to a user field would put a hostname in a username: the rule would parse, cite a real stored value, and match nothing' (none): payload.detection_type on SEC-0003-b is 'regular_interval', which is this platform's own detector label rather than a field of the source log. Sigma matches what the log recorded, not what we concluded from it, so there is no field for this and inventing one would encode our verdict as somebody else's observation (prose): labels.summary on SEC-0003-b names the detail a stronger rule would key on, in prose written for a human. Parsing hostnames out of it would make the rule depend on sentence structure, which is the guessing this module refuses everywhere else x-warning: Every field in this rule is an instance value from this incident. It would have matched this occurrence and will not match another; it is an indicator match, not a behavioural detection.

# DRAFT - assembled from one incident's stored telemetry. Not deployed, # not validated against a live log pipeline, and not adopted. # Incident: INC-2026-0903 # Technique: T1021.002 SMB/Windows Admin Shares (Lateral Movement) # # Every field below was read from a stored event: # Computer <- entity_ref.id (matches this incident only); SEC-0003-c # # This telemetry could not supply, and a reviewer should add: # EventID - no stored event for this step carries EventID; the normalized event model (events.py) has no field it maps from, so a rule for T1021.002 keying on it would be inventing the value # ShareName - no stored event for this step carries ShareName; the normalized event model (events.py) has no field it maps from, so a rule for T1021.002 keying on it would be inventing the value # RelativeTargetName - no stored event for this step carries RelativeTargetName; the normalized event model (events.py) has no field it maps from, so a rule for T1021.002 keying on it would be inventing the value # SubjectUserName - no stored event for this step carries SubjectUserName; the normalized event model (events.py) has no field it maps from, so a rule for T1021.002 keying on it would be inventing the value # IpAddress - no stored event for this step carries IpAddress; the normalized event model (events.py) has no field it maps from, so a rule for T1021.002 keying on it would be inventing the value # # WARNING: every field is an instance value. This matches this incident and not the technique. title: 'Draft: SMB/Windows Admin Shares observed in INC-2026-0903' id: 33be0cf0-d63a-5762-bcac-225a976bbcea status: experimental description: 'Drafted from INC-2026-0903, which recorded: SMB opened to two hosts never previously contacted. Fields below were read from SEC-0003-c. Some fields this technique usually keys on are absent - see x-gaps.' references: - INC-2026-0903 - SEC-0003-c author: Sati (drafted from one incident; not validated against live telemetry) date: 2026/10/18 tags: - attack.lateral_movement - attack.t1021.002 logsource: category: security product: pashupatastra service: demo detection: selection: Computer: ws-0148 condition: selection falsepositives: - Every field is specific to INC-2026-0903 (Computer=ws-0148). This will match unrelated activity on the same entities and nothing elsewhere. - The selection tests a single field (Computer), so anything carrying that value matches regardless of behaviour. level: high x-provenance: Computer: source_field: entity_ref.id observed_in: - SEC-0003-c generalises: false x-gaps: EventID: no stored event for this step carries EventID; the normalized event model (events.py) has no field it maps from, so a rule for T1021.002 keying on it would be inventing the value ShareName: no stored event for this step carries ShareName; the normalized event model (events.py) has no field it maps from, so a rule for T1021.002 keying on it would be inventing the value RelativeTargetName: no stored event for this step carries RelativeTargetName; the normalized event model (events.py) has no field it maps from, so a rule for T1021.002 keying on it would be inventing the value SubjectUserName: no stored event for this step carries SubjectUserName; the normalized event model (events.py) has no field it maps from, so a rule for T1021.002 keying on it would be inventing the value IpAddress: no stored event for this step carries IpAddress; the normalized event model (events.py) has no field it maps from, so a rule for T1021.002 keying on it would be inventing the value x-not-mapped: SubjectUserName: 'payload.principal on SEC-0003-c is ''ws-0148'', which is a host and not an account. Mapping it to a user field would put a hostname in a username: the rule would parse, cite a real stored value, and match nothing' (none): payload.detection_type on SEC-0003-c is 'new_smb_peer', which is this platform's own detector label rather than a field of the source log. Sigma matches what the log recorded, not what we concluded from it, so there is no field for this and inventing one would encode our verdict as somebody else's observation (prose): labels.summary on SEC-0003-c names the detail a stronger rule would key on, in prose written for a human. Parsing hostnames out of it would make the rule depend on sentence structure, which is the guessing this module refuses everywhere else x-warning: Every field in this rule is an instance value from this incident. It would have matched this occurrence and will not match another; it is an indicator match, not a behavioural detection.

# DRAFT - assembled from one incident's stored telemetry. Not deployed, # not validated against a live log pipeline, and not adopted. # Incident: INC-2026-0903 # Technique: T1053.005 Scheduled Task (Persistence) # # Every field below was read from a stored event: # Image <- entity_ref.id (generalises); SEC-0003-d # # This telemetry could not supply, and a reviewer should add: # EventID - no stored event for this step carries EventID; the normalized event model (events.py) has no field it maps from, so a rule for T1053.005 keying on it would be inventing the value # TaskName - no stored event for this step carries TaskName; the normalized event model (events.py) has no field it maps from, so a rule for T1053.005 keying on it would be inventing the value # SubjectUserName - no stored event for this step carries SubjectUserName; the normalized event model (events.py) has no field it maps from, so a rule for T1053.005 keying on it would be inventing the value # CommandLine - no stored event for this step carries CommandLine; the normalized event model (events.py) has no field it maps from, so a rule for T1053.005 keying on it would be inventing the value title: 'Draft: Scheduled Task observed in INC-2026-0903' id: 077ababc-d0ac-5757-a4f7-19ea21a77175 status: experimental description: 'Drafted from INC-2026-0903, which recorded: scheduled task created on app-07 from a remote session. Fields below were read from SEC-0003-d. Some fields this technique usually keys on are absent - see x-gaps.' references: - INC-2026-0903 - SEC-0003-d author: Sati (drafted from one incident; not validated against live telemetry) date: 2026/10/18 tags: - attack.persistence - attack.t1053.005 logsource: category: security product: pashupatastra service: demo detection: selection: Image: schtasks condition: selection falsepositives: - The selection tests a single field (Image), so anything carrying that value matches regardless of behaviour. level: high x-provenance: Image: source_field: entity_ref.id observed_in: - SEC-0003-d generalises: true x-gaps: EventID: no stored event for this step carries EventID; the normalized event model (events.py) has no field it maps from, so a rule for T1053.005 keying on it would be inventing the value TaskName: no stored event for this step carries TaskName; the normalized event model (events.py) has no field it maps from, so a rule for T1053.005 keying on it would be inventing the value SubjectUserName: no stored event for this step carries SubjectUserName; the normalized event model (events.py) has no field it maps from, so a rule for T1053.005 keying on it would be inventing the value CommandLine: no stored event for this step carries CommandLine; the normalized event model (events.py) has no field it maps from, so a rule for T1053.005 keying on it would be inventing the value x-not-mapped: SubjectUserName: 'payload.principal on SEC-0003-d is ''app-07/schtasks'', which is a process and not an account. Mapping it to a user field would put a hostname in a username: the rule would parse, cite a real stored value, and match nothing' (none): payload.detection_type on SEC-0003-d is 'scheduled_task_created', which is this platform's own detector label rather than a field of the source log. Sigma matches what the log recorded, not what we concluded from it, so there is no field for this and inventing one would encode our verdict as somebody else's observation (prose): labels.summary on SEC-0003-d names the detail a stronger rule would key on, in prose written for a human. Parsing hostnames out of it would make the rule depend on sentence structure, which is the guessing this module refuses everywhere else

INC-2026-0903

Causal chain

Diagnosis

Also considered

Remediation plan

Timeline

The loop

Detection

Authorization

Why this tier

Draft post-incident report — INC-2026-0903

What happened

Draft playbook — INC-2026-0903

What this was

How it unfolded

The plausible and wrong explanation

The case for it

What rules it out

Where each rests

If we had acted sooner

What would not have happened

What this estimate rests on

Draft: Web Protocols observed in INC-2026-0903

Telemetry field to rule field

Draft: SMB/Windows Admin Shares observed in INC-2026-0903

Telemetry field to rule field

What this telemetry could not supply

Draft: Scheduled Task observed in INC-2026-0903

Telemetry field to rule field

What this telemetry could not supply

Audit trail

Scenarios · 5

Hypothesis

Plan

Approval

Execution

Verification

Why the risk rose

What success will look like

What was ruled out

What was done

What was verified

What to do

How to tell it worked

What this telemetry could not supply

Held, and deliberately not mapped

The rule

Held, and deliberately not mapped

The rule

Held, and deliberately not mapped

The rule

What this reached

What this reached