SOC168 EventID:118 — Whoami Command Detected in Request Body — letsdefend.io

SOC168 EventID:118 — Whoami Command Detected in Request Body — letsdefend.io

Let’s take a look at the alert report below.

 
EventID :118
Event Time :Feb, 28, 2022, 04:12 AM
Rule :SOC168 - Whoami Command Detected in Request Body
Level :Security Analyst
Hostname :WebServer1004
Destination IP Address :172.16.17.16
Source IP Address :61.177.172.87
HTTP Request Method :POST
Requested URL :https://172.16.17.16/video/
User-Agent :Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
Alert Trigger Reason :Request Body Contains whoami string
Device Action :Allowed

The reason …

blue team incident response letsdefendio soc