SOC257 - VPN Connection Detected from Unauthorized Country
A writeup of a response to an alert in a simulated SOC from LetsDefend.
Summary
TRUE POSITIVE
A malicious IP address (113[.]161[.]158[.]12) from an unauthorized country (Vietnam) attempted to log into the VPN under the account monica[@]letsdefend[.]io. All login attempts were blocked due to incorrect OTP entries, and MFA prevented any intrusion onto the network.
Alert
An alert for a VPN connection from an IP in an unauthorized country came in attempting to connect to our VPN using user monica[@]letsdefend[.]io. First we should check our log management platform using the source IP to see if the connection attempts were successful.
Investigation
Verification
Looking into the firewall logs we can identify that there were multiple login attempts from the unrecognized IP around 2 A.M. All 3 attempts were unsuccessful due to the OTP being incorrect. This suggests that Monica’s credentials may be compromised, but there was no intrusion onto the network.
Firewall logs showing 3 unsuccessful login attempts due to incorrect OTP
Performing a whois search of the IP shows us the offending IP is from Vietnam, making this a true positive event. We should immediately force a password reset on Monica’s account and notify her of the access attempts to be safe.
whois lookup of the offending IP
OTP Emails
Checking the mail server, we can see Monica received 3 OTP emails at monica[@]letsdefend[.]io.
OTP emails sent to Monica
IP Analysis
Running the offending IP through our threat intel sources reveals this is a malicious IP tied to multiple brute-force / unauthorized access attempts.
VirusTotal report
Internal threat intel report
Recommendations
- Reset user monica[@]letsdefend[.]io credentials as a precaution
- Notify Monica to confirm she did not attempt this login
- Block IP 113[.]161[.]158[.]12 at the firewall/VPN gateway
- Continue monitoring for further attempts from this IP
- No further containment needed — MFA prevented unauthorized access
Appendix
Artifacts
| Type | Value |
|---|---|
| Malicious IP | 113[.]161[.]158[.]12 |
| Compromised User | monica[@]letsdefend[.]io |